topic Re: Need help in parsing below Azure nsg log in Getting Data In https://community.splunk.com/t5/Getting-Data-In/Need-help-in-parsing-below-Azure-nsg-log/m-p/578108#M102089 <P>If you can't use the app itself then perhaps you can use it as a guide for building your own app.</P><P>You also may be able to find the log format on-line, perhaps at&nbsp;<A href="https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-nsg-flow-logging-overview#log-format" target="_blank">https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-nsg-flow-logging-overview#log-format</A></P> Sat, 11 Dec 2021 13:05:13 GMT richgalloway 2021-12-11T13:05:13Z Need help in parsing below Azure nsg log https://community.splunk.com/t5/Getting-Data-In/Need-help-in-parsing-below-Azure-nsg-log/m-p/578059#M102085 <P>Hi all,</P><P>This is the sample Azure nsg log ingested from Azure log analytics&nbsp;<BR /><BR />"aaaedbb3-407b-4d6c-9f11-dc4640e9acf4", "Azure", "", "", "2021-12-10T19:06:17.001Z", "", "", "", "", "", "", "", "", "", "", "2", "2021-12-10T18:00:00Z", "2021-12-10T19:00:00Z", "2021-12-10T18:09:01Z", "2021-12-10T18:36:26Z", "S2S", "", "10.115.1.77", "34.206.244.234", "", 54443, "T", "Unknown", "O", false, "A", "d88af0da-cfee-4f3e-bb50-58341fe4e132/c-hal-it-ss-prod-eus-rg/cap-subnet1-nsg", "0|cap_mgmt_to_hal|O|A|4", "cap_mgmt_to_hal", "UserDefined", "d88af0da-cfee-4f3e-bb50-58341fe4e132", "", "eastus", "", "c-halazops-connectivity-eus-criticalassetprotection-rg/np1caps009v-nic1", "c-halazops-connectivity-eus-criticalassetprotection-rg/np1caps009v-nic1", "", "c-halazops-connectivity-eus-criticalassetprotection-rg/np1caps009v", "c-halazops-connectivity-eus-criticalassetprotection-rg/np1caps009v", "", "c-hal-it-ss-prod-eus-rg/c-hal-it-ss-prod-eus-vnet1/cap-subnet1", "", "", "", "", "", "", "", "", "d88af0da-cfee-4f3e-bb50-58341fe4e132/c-hal-it-ss-prod-scus-rg/c-hal-it-ss-prod-scus-er2", "AzurePrivatePeering", "d88af0da-cfee-4f3e-bb50-58341fe4e132/c-hal-it-ss-prod-eus-rg/c-hal-it-ss-prod-eus-scus-conn2", "", "", "", 0, 0, 4, 0, 4, 39, 34, 26863, 4706, 4, "", "", "", null, "", "", "", "", "", "", "", null, "", "", "", "", "", "", "ExpressRoute", null, "", null, "", "", null, "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "c-hal-it-ss-prod-eus-rg/c-hal-it-ss-prod-eus-vnet1/cap-subnet1", "", "", "", "", "", "", null, null, "", null, "", "", "", "", null, null, "", "", "", null, null, "", "", null, null, "", null, "", "", "", null, "", "", "", "", "eastus", "", "FlowLog", "d88af0da-cfee-4f3e-bb50-58341fe4e132", "", "2021-12-10T19:06:11.622Z", "", "", "", "", "", "", "", null, "", "", "", null, "", "", "", "", "", "", null, "00-0D-3A-1A-C0-F7", "", "", "", "", null, "", "", null, null, null, null, "", "", "AzureNetworkAnalytics_CL", ""</P><P>Can anybody please help me in parsing and get into meaningful data.</P> Fri, 10 Dec 2021 19:58:41 GMT https://community.splunk.com/t5/Getting-Data-In/Need-help-in-parsing-below-Azure-nsg-log/m-p/578059#M102085 nilbak88 2021-12-10T19:58:41Z Re: Need help in parsing below Azure nsg log https://community.splunk.com/t5/Getting-Data-In/Need-help-in-parsing-below-Azure-nsg-log/m-p/578079#M102086 <P>Have you checked to see if an add-on exists that might help?&nbsp; Perhaps&nbsp;<A href="https://splunkbase.splunk.com/app/3757/" target="_blank" rel="noopener">https://splunkbase.splunk.com/app/3757/</A>&nbsp;?</P> Sat, 11 Dec 2021 12:56:59 GMT https://community.splunk.com/t5/Getting-Data-In/Need-help-in-parsing-below-Azure-nsg-log/m-p/578079#M102086 richgalloway 2021-12-11T12:56:59Z Re: Need help in parsing below Azure nsg log https://community.splunk.com/t5/Getting-Data-In/Need-help-in-parsing-below-Azure-nsg-log/m-p/578101#M102088 <P>Thanks&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/213957">@richgalloway</a>&nbsp;<BR />This add-on is not supported by Splunk and we already tried with this add-on, were not getting desired results.<BR />So, tried to get results with&nbsp;Azure Log Analytics Kusto Grabber Splunk addon.<BR />So, need help if we can parse above pasted logs.<BR />Please suggest</P><P>&nbsp;</P><P>&nbsp;</P> Sat, 11 Dec 2021 09:46:56 GMT https://community.splunk.com/t5/Getting-Data-In/Need-help-in-parsing-below-Azure-nsg-log/m-p/578101#M102088 nilbak88 2021-12-11T09:46:56Z Re: Need help in parsing below Azure nsg log https://community.splunk.com/t5/Getting-Data-In/Need-help-in-parsing-below-Azure-nsg-log/m-p/578108#M102089 <P>If you can't use the app itself then perhaps you can use it as a guide for building your own app.</P><P>You also may be able to find the log format on-line, perhaps at&nbsp;<A href="https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-nsg-flow-logging-overview#log-format" target="_blank">https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-nsg-flow-logging-overview#log-format</A></P> Sat, 11 Dec 2021 13:05:13 GMT https://community.splunk.com/t5/Getting-Data-In/Need-help-in-parsing-below-Azure-nsg-log/m-p/578108#M102089 richgalloway 2021-12-11T13:05:13Z