All Apps and Add-ons

Parsing Issue

rbonfadini
New Member

I have the 6.0.2 TA deployed per the instructions.

I'm receiving parsed logs for pan:threat, config, traffic, and system. I'm still receiving pan:log, which I believe should be parsing out to pan:hipmatch.

What may be the issue where some, but not all sourcetypes are being parsed out correctly?

0 Karma
1 Solution

splunker12er
Motivator

Check your TA props.conf - stanza TRANSFORMS-sourcetype has config for pan_hipmatch and in your transforms.conf you can verify the stanza [pan_hipmatch] and confirm the REGEX that would need to match your log source - if there it should route the log source to this particular sourcetype and parse accordingly..

View solution in original post

0 Karma

splunker12er
Motivator

Check your TA props.conf - stanza TRANSFORMS-sourcetype has config for pan_hipmatch and in your transforms.conf you can verify the stanza [pan_hipmatch] and confirm the REGEX that would need to match your log source - if there it should route the log source to this particular sourcetype and parse accordingly..

0 Karma

rbonfadini
New Member

You were correct. OOTB transforms.conf regex for hipmatch wasn't lining up with our log output. Had to tweak the regex. Thank you.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...