Description

This add-on provides transforms for CEF headers and key/values extraction and 'cefkv' command for extractling custom strings (useful for dealing with Arcsight logs)

CEFUtils - Common Event Format Extraction Utilities

The common event format is an event exchange syntax. A sample message formatted as CEF looks as follows:
CEF:0|Splunk|Test|1.0|signature:2|Test event|5|src_addr=10.0.0.0 dest_addr=20.0.0.2 src_port=32122 dest_port=80
It consists of a common prefix that always has to be present, followed by a flexible key-value extension.

In order to parse CEF data correctly in Splunk, this add-on provides 2 transforms:

• cefHeaders - use it to extract CEF headers
• cefKeys - fixes multiword value extraction (by default Splunk would only extract key's values up to the first whitespace character)

This add-on also provides a cefkv command, that should be used for extracting custom keys/value pairs from CEF data - usefull if you are dealing with Arcsight events.

Example:
CEF:0|Splunk|Test|1.0|signature:2|Test event|5|cs1=custom string value cs1Label=custom label

cefkv will extract following key/value pair from the sample message above: custom_label="custom string value"