ALERT! The community will be read-only starting on April 19, 8am Pacific as the migration begins. Read more for important details.
ALERT! The community will be read-only starting on April 19, 8am Pacific as the migration begins.Read more for important details.
Absent Member.
Absent Member.
638 views

parse CSV in file transfer receiver for logger

We are pulling some files off our proxy to the logger.  The proxy, which does not have a connector available for arcsight, logs in a CSV compatible format to the local disk.  How would we format that into CEF so that arcsight can read it?
Labels (2)
0 Likes
5 Replies
Captain
Captain

Hi Mike,

strane that no one replied to your message so far. If you have log files in CSV, then you are big step toward the resolution of your issue. You need to prepare flex connector and parse these CSV files on the source system itself. If that proxy is Linux or Windows, no problem with installing ArcSight connector, and develope flex connector (regex or whatever).

For more info on flex connectors, look for FlexConnectorDevConfig.pdf document, somewhere on Arcsight's documentation web site.

Milan

0 Likes

I didn't see your original post, but thanks to Milan's follow-up I saw it re-surface.

Flex connectors for a CSV are actually about as easy as it gets since  you don't have to use regex to capture the tokens. I've got one or two  CSV flex connectors, and you just need to define the comma as a  delimiter, quotation marks as the text qualifier, and define the number  of tokens that need to be captured. It also helps to trim empty tokens  (removing leading and hanging white space) and let the parser know  whether any of the tokens might ever be empty.

Start  with something like this:

delimiter=,
text.qualifier="
comments.start.with=\#
trim.tokens=true
contains.empty.tokens=true

token.count=8

0 Likes
Cadet 2nd Class Cadet 2nd Class
Cadet 2nd Class

Hello,

But which exactly FlexAgent do you use? I've installed ArcSight FlexConnector File but somehow it does not extract the events into Manager. P.S. Seems like the .sdkfilereader.properties file configuration is fine.

Thx,

Gintautas

0 Likes
Captain
Captain

Hi Gintautas,

sorry for late reply, but I was bussy. You should use Log File Flex Connector type (well documented in Flex Connector Developers Guide). If you can post more details about your flex connector, maybe someone can help.

Milan

0 Likes
Absent Member.
Absent Member.

problem solved in that we are having to get the logs and transform them via some code for another process... I am now outputting it into CEF format and feeding into a CEF file connector.

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.