we're getting the syslogs exports from our Forcepoint appliances, using their standardised SIEM integration. The format of the output generally works except for "user".
Because the Forcepoint syslogger insists on listing the full LDAP path of the user, it's littered with commas and equals, but has no external delimiter:
user=LDAP://ldap.emea.company.loc OU=PST Disable Test,OU=Test,DC=emea,DC=Company,DC=loc/surname\, first
Splunk parses this as user= "LDAP://ldap.emea.company.loc"
can force remove teh Spaces with "_" using Forcepoint's escape sequences, which results in:
user=LDAP://ldap.emea.company.loc_OU=PST_Disable_Test,OU=Test,DC=emea,DC=company,DC=loc/surname_,_first
which Splunk interprets as:
user = "LDAP://ldap.emea.company.loc_OU=PST_Disable_Test"
any suggestions as to how i can delimit or replace the field to just contain something Splunk can recognise?
That's the crux of the issue. There's nothing obvious to use. In fact characters within the value are reasonably being interpreted as the terminator.
I either need to teach the Forcepoint Appliance how to write it's log better, or hope some Splunking Hero has figured out how to get Splunk to parse this better.
Eric
That's the crux of the issue. There's nothing obvious to use. In fact characters within the value are reasonably being interpreted as the terminator.
I either need to teach the Forcepoint Appliance how to write it's log better, or hope some Splunking Hero has figured out how to get Splunk to parse this better.
Eric
Found my own answer: https://answers.splunk.com/answers/453509/websense-stripping-ldap-ou-dc-strings-from-user-fi.html
I also downloaded the Websense plug CIM module for Splunk, which contains this already.
What DOES delimit the user field? If it's not a space, not a comma, what would tell one that the end of the user string is there?