Cortex XDR and splunk logging

Vadim_Lisserman — Tue, 28 Apr 2026 17:27:03 GMT

Has anyone noticed that splunk logging format has changed for xdr logs, including the sourcetype?

Re: Cortex XDR and splunk logging

susekar — Tue, 28 Apr 2026 18:51:44 GMT

Greetings for the day.

As of now, we have not received any cases or reported issues related to this.

However, this behavior could be associated with the transition to Cortex XDR versions 4.x and 5.0. Such upgrades may impact how Splunk ingests and categorizes data, potentially affecting sourcetypes and the availability of specific fields.

Troubleshooting Recommendations:

If you notice format changes affecting your Splunk environment:

Check the "Legacy Log Format" Setting:
Ensure this setting is enabled if your Splunk parsers were built for older XDR versions.
Verify CEF vs. LEEF Headers:
Confirm that the log format configured in XDR Syslog matches the input configuration on your Splunk Heavy Forwarder or Universal Forwarder.
Use API for Detailed Data:
For fields that may be truncated or missing in standard CEF syslog (such as detailed descriptions or file hashes), it is recommended to use the Cortex XDR REST API (for example, /public_api/v1/incidents/get_incident_extra_data/) to retrieve more comprehensive data into Splunk.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar

topic Re: Cortex XDR and splunk logging in Cortex XDR Discussions

Cortex XDR and splunk logging

Re: Cortex XDR and splunk logging

Troubleshooting Recommendations: