topic Re: Parsing Syslog csv format- Why does syslog add time and host fields at the beginning of my log? in Splunk Enterprise

Parsing Syslog csv format- Why does syslog add time and host fields at the beginning of my log?

elkatane — Thu, 08 Jun 2023 14:39:23 GMT

Hello

I have a problem parsing this csv format log, the problem is that syslog adds Time and host fields at the beginning of my log.

Jun 8 10:47:33 sv43562 "Thu Jun 8 10:47:05 2023","email@gmail.com","HTTPS","url","Allowed","General Browsing","General Browsing","Travel","Travel","None","None","0","None","None","GET","200","Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0),"None"

How can I fix this?

Thanks for your help.

Re: Parsing Syslog csv format

elkatane — Thu, 08 Jun 2023 13:32:13 GMT

Re: Parsing Syslog csv format- Why does syslog add time and host fields at the beginning of my log?

elkatane — Fri, 09 Jun 2023 09:16:55 GMT

Props.conf :

SEDCMD-removeheader = s/^\w{3}\s+\d+\s+\d{2}:\d{2}:\d{2}\s+\w{8}\s+/g