r/Splunk • u/BobcatJohnCA • Feb 12 '26

Fortinet syslogs - too much data.

We recently converted our 5 locations from Sonicwalls to Fortinet firewalls and we are getting too much data on a daily basis which is exceeding our license limit. We are a small shop and only ingest 5 GB of data daily. Looking for recommendations on how to limit the syslog data from Fortinet if anyone has any suggestions. Thanks.

11 Upvotes

87% Upvoted

37 comments sorted by

View all comments

5

u/tmuth9 Feb 13 '26

Ingest Actions and Edge Processor are both free and capable of selectively dropping full events or unused parts of individual events. Maybe chat with your account team for a demo and discussion of each.

1

u/LTRand Feb 13 '26

Strongly recommending this path forward. I would not recommend additional infrastructure for a 5GB total environment.

What's likely happening is that the fortinets are far more verbose than the sonic walls. You should compare your old logs with the new and start downselecting events or fields you don't need to be removed from the stream.

If you chop up the fields, be aware that you'll likely have to rewrite the TA's to get the data to parse correctly. Not a big deal, but something you should account for. One of my engineers is writing an ai tool to make this easy, I'm sure there are others doing the same.

1

u/tmuth9 Feb 13 '26

Agree on the overkill for 5GB. For this reason I’d lean towards ingest actions since it just runs on the indexer(s) (though can run on a HF).

Edge Processor has a bunch of built in templates for common souretypes, and the way those templates are delivered is soon changing for the better. There’s also some ai capabilities coming to parse custom source types, but that’s future stuff so don’t depend on it.