Splunk App for CEF

The Splunk App for CEF enables you to augment, filter, and aggregate Splunk Enterprise events, transforming them into the Common Event Format (CEF), an open log management standard. Use Splunk Enterprise to gain faster, easier, and deeper insights across all machine data, and add context to events by using Splunk add-ons and custom lookups. When you are ready, map Splunk fields to CEF fields using data models, with no knowledge of the Splunk search syntax required, and then output them to a syslog receiver in common event format.