Getting Data In

What would be the most efficient way of parsing pfSense 2.2 logs' new format? Regex, CSV or some other way?

Biggsy
Engager

Hi,

I've been using Splunk for a while but only in a very basic way, by monitoring my Kiwi syslog files.

pfSense 2.2 is currently in release candidate stage and a new log format has been introduced with this version. Among other things, this avoids the multi-line syslog problems documented elsewhere in Splunk>answers.

The documentation about the new log format is located here:
https://doc.pfsense.org/index.php/Filter_Log_Format_for_pfSense_2.2

Firstly, what would be the most efficient way of parsing these logs in Splunk? With regex, as CSV or some other way?

It also seems that, depending on the value of one field, the following fields will vary. How is it possible to take that into account during the parsing?

Any help very much appreciated. Thanks.

Tags (3)

amiracle
Splunk Employee
Splunk Employee

I ended up using REGEX to parse the logs since it has different fields depending on the type of protocol (TCP, UDP, etc.) I can share with you what I did to parse the pfsense logs in my Home Monitor App for Splunk.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...