Troubleshooting

Use this guide to resolve common issues when analyzing Cloudflare Logs ↗ through the Cloudflare App for Splunk.

Events under the cloudflare:json sourcetype for the Firewall Events dataset carry _time values that do not match the event's actual time, and splunkd.log shows entries similar to:

WARN DateParserVerbose - Failed to parse timestamp.
Defaulting to timestamp of previous event.

Cause: In older versions of the Cloudflare App for Splunk, the cloudflare:json sourcetype extracts _time from the EdgeStartTimestamp JSON key, which only exists in HTTP requests logs. Firewall Events use a different key (Datetime), so timestamp extraction fails and Splunk silently falls back to the timestamp of the most recently indexed event.

Fix: Upgrade to the latest version of the Cloudflare App for Splunk ↗. The current release parses both EdgeStartTimestamp and Datetime under the cloudflare:json sourcetype.

If you cannot upgrade immediately, or if you maintain a customized props.conf, update the cloudflare:json stanza on your indexer or heavy forwarder to match both keys, then restart the Splunk service:

[cloudflare:json]
TRUNCATE = 100000
TIME_PREFIX = "(?:EdgeStartTimestamp|Datetime)"\s*:\s*"
TIME_FORMAT = %Y-%m-%dT%H:%M:%SZ
MAX_TIMESTAMP_LOOKAHEAD = 150

Verify: Newly indexed Firewall Events carry accurate _time values, and DateParserVerbose warnings no longer appear in splunkd.log. Events indexed before the fix retain their original _time values unless they are re-indexed.

The Cloudflare – Security (WAF) dashboard in the Cloudflare App for Splunk loads without errors, but all panels are empty. Other dashboards (Overview, Performance, Reliability) populate normally, and running the WAF panels' underlying SPL directly in the search bar also returns zero results — even when WAF and security events are confirmed present in the target index.

Cause: In older versions of the Cloudflare App for Splunk, the WAF dashboard SPL references Cloudflare log fields that were removed from the HTTP Requests dataset on August 1, 2023:

Splunk does not raise an error when a search references a field that is absent from all indexed events — it completes the search and returns zero results, leaving every dashboard panel empty.

Fix: Upgrade to the latest version of the Cloudflare App for Splunk ↗. The current release references SecurityRuleIDs and SecurityRuleDescription throughout the WAF dashboard, saved searches, and macros.

If you maintain a customized fork of the app, replace all references to FirewallMatchesRuleIDs{} and WAFRuleMessage in your dashboard XML, saved searches, and macros with SecurityRuleIDs and SecurityRuleDescription, respectively.

Verify: Reload the Cloudflare – Security (WAF) dashboard. Panels should populate with recent WAF and security events. A direct search such as index=<your-index> sourcetype=cloudflare:json SecurityRuleIDs=* should also return matching events.

If your issue is not covered above:

• Consult the Cloudflare App for Splunk page ↗ on Splunkbase for the latest version and release notes.
• Review the Cloudflare Logs change notices for recent schema changes that may affect your searches or dashboards.
• Contact Cloudflare Support for issues involving Cloudflare-side log delivery.
• Contact your Splunk representative or your integration partner for issues within your Splunk environment.