https://community.splunk.com/t5/Deployment-Architecture/Processing-Microsoft-multi-factor-authentication-server-logs/m-p/458318#M24695 <P>I am injecting logs from Microsoft multi-factor authentication server. Unfortunately, the log entries are rather inconsistent. Here is the example of logs depicting successful SMS-based authentication in reverse chronological order</P> <P>May 13 11:12:54 server01 pfsvc: i|pendingSmses|updateSmsResult|#25c50ee6-d8fa-4725-96dd-dc7be580fadf|Updated authentication result. Call status: SUCCESS_SMS_AUTHENTICATED - SMS Authenticated<BR /> May 13 11:12:17 server01 pfsvc: Pfauth failed for user '<A href="mailto:user1.lastname@mydomain.com" target="_blank">user1.lastname@mydomain.com</A>' from 184.152.232.200. Call status: SUCCESS_SMS_SENT - "One-way SMS Sent".</P> <P>As you can see the username and IP address is listed on one line and the result of the authentication is on the other. How can I build correlation between usernames and authentication results? I am not sure if my idea of stitching lines together with different LINE BREAKER in props.conf is a good one, since there are other non-authentication related log entries, which such approach may screw up.</P> <P>Please, advise. Your suggestions will be greatly appreciated.</P> Wed, 30 Sep 2020 00:33:18 GMT ageld 2020-09-30T00:33:18Z https://community.splunk.com/t5/Deployment-Architecture/Processing-Microsoft-multi-factor-authentication-server-logs/m-p/458318#M24695 <P>I am injecting logs from Microsoft multi-factor authentication server. Unfortunately, the log entries are rather inconsistent. Here is the example of logs depicting successful SMS-based authentication in reverse chronological order</P> <P>May 13 11:12:54 server01 pfsvc: i|pendingSmses|updateSmsResult|#25c50ee6-d8fa-4725-96dd-dc7be580fadf|Updated authentication result. Call status: SUCCESS_SMS_AUTHENTICATED - SMS Authenticated<BR /> May 13 11:12:17 server01 pfsvc: Pfauth failed for user '<A href="mailto:user1.lastname@mydomain.com" target="_blank">user1.lastname@mydomain.com</A>' from 184.152.232.200. Call status: SUCCESS_SMS_SENT - "One-way SMS Sent".</P> <P>As you can see the username and IP address is listed on one line and the result of the authentication is on the other. How can I build correlation between usernames and authentication results? I am not sure if my idea of stitching lines together with different LINE BREAKER in props.conf is a good one, since there are other non-authentication related log entries, which such approach may screw up.</P> <P>Please, advise. Your suggestions will be greatly appreciated.</P> Wed, 30 Sep 2020 00:33:18 GMT https://community.splunk.com/t5/Deployment-Architecture/Processing-Microsoft-multi-factor-authentication-server-logs/m-p/458318#M24695 ageld 2020-09-30T00:33:18Z