Getting Data In

What would be the most efficient way of parsing pfSense 2.2 logs' new format? Regex, CSV or some other way?

Biggsy
Engager

Hi,

I've been using Splunk for a while but only in a very basic way, by monitoring my Kiwi syslog files.

pfSense 2.2 is currently in release candidate stage and a new log format has been introduced with this version. Among other things, this avoids the multi-line syslog problems documented elsewhere in Splunk>answers.

The documentation about the new log format is located here:
https://doc.pfsense.org/index.php/Filter_Log_Format_for_pfSense_2.2

Firstly, what would be the most efficient way of parsing these logs in Splunk? With regex, as CSV or some other way?

It also seems that, depending on the value of one field, the following fields will vary. How is it possible to take that into account during the parsing?

Any help very much appreciated. Thanks.

Tags (3)

amiracle
Splunk Employee
Splunk Employee

I ended up using REGEX to parse the logs since it has different fields depending on the type of protocol (TCP, UDP, etc.) I can share with you what I did to parse the pfsense logs in my Home Monitor App for Splunk.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...