Can Splunk read CEF or LEEF format of syslog? That has field information included, so should be easy to parse.
There is a Tech Note on Splunk with ClearPass, but it refers to probably the same deprecated extension. I can't find it in the extension search. The note may have some guidance for setting up syslog, just in case you didn't find the document yet.
------------------------------
Herman Robers
------------------------
If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check
https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.
In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
------------------------------
Original Message:
Sent: Aug 27, 2024 08:38 AM
From: wiseguy333
Subject: Clearpass logging to Splunk
Good morning,
We are currently using CPPM 6.11.9 and are a splunk cloud customer and using the typical clearpass syslog export filter.
The clearpass data comes into our splunk environment in a raw format so pretty useless. We'd like to be able to do the field extractions using the Clearpass Splunk app but the app is depricated on splunkbase and does not support our versions of CPPM or Splunk. So what are folks using? Are other customers using the depricated Splunk app or some other method?
Thanks