topic label fields in a flat file in Getting Data In

label fields in a flat file

udiggity — Tue, 08 Mar 2011 03:11:05 GMT

I have activity files from a vpn radius server and I'd like to label the fields as they go into splunk... I'm not even sure where to look for this info at, can someone help point me in the right direction?

Essentially I have this

03/07/2011","14:06:53","VPN","Start","username","7","common name","IP address","1878", etc and I'd like those fields to become labeled and searchable in the index. Thanks for any help you can give, I'm very new to splunk and fumbling my way through.

Re: label fields in a flat file

jasonnadeau — Tue, 08 Mar 2011 03:36:23 GMT

You can assign a sourcetype to those VPN records and then perform field extraction on those fields you wish. I would first start by assigning the sourcetype field to the inputs.conf that collects those logs. I am assuming they are on disk so you would configure something like this

[monitor:///var/log/VPN/logfile.log]]
sourcetype=VPN_logs

Then use the Interactive field extraction specified here. There are some other ways to extract fields based upon host or based upon regular expressions. I choose to use sourcetype to do my field extractions because I can easily add another host or source of similar log files in the future. Similarly people use object groups in firewalls rather than single IP address entries because its easier to modify in the future.

Re: label fields in a flat file

udiggity — Wed, 09 Mar 2011 19:25:48 GMT

Thanks for the reply, sorry I just got back in to the office, so I will try this now. Thanks again, I will let you know how it goes.