splunk
Webfilter (M86 Secure Web Gateway) Field Extractions
This app has been archived. Learn more about app archiving.
This app is NOT supported by Splunk. Please read about what that means for you here.
Overview
I wasn't able to find any existing field extractions for the standard syslog output of the M86 Secure Web Gateway appliance that we've recently implemented. Due to the way that the output is formatted by the appliance, the default extractions that Splunk does itself are quite poor.
Using our log output as a basis (note, this is with ALL fields being sent by the appliance. If you've modified the fields sent by the appliance in any way, you'll have to modify the extractions in transforms.conf accordingly), this extracts all the information properly, and field names have been matched up with the Splunk Common Information Model where it made sense.
The sourcetype "webfilter" is added by this add-on, so please make sure that your M86 logs are sourcetyped to that name in order for these to be properly applied.
Finally, this also disables the automatic Splunk field extractions (KV_MODE = none) for the webfilter sourcetype, since the automated extraction was so poor, and just caused redundant output.
Using our log output as a basis (note, this is with ALL fields being sent by the appliance. If you've modified the fields sent by the appliance in any way, you'll have to modify the extractions in transforms.conf accordingly), this extracts all the information properly, and field names have been matched up with the Splunk Common Information Model where it made sense.
The sourcetype "webfilter" is added by this add-on, so please make sure that your M86 logs are sourcetyped to that name in order for these to be properly applied.
Finally, this also disables the automatic Splunk field extractions (KV_MODE = none) for the webfilter sourcetype, since the automated extraction was so poor, and just caused redundant output.
Release Notes
Version 1.0
Sept. 26, 2011