topic Re: rebuild a syslog event in Getting Data In

rebuild a syslog event

asabatini — Tue, 27 Feb 2024 21:25:15 GMT

Hi Folks,

I have a quick question.

currently I have a syslog event and I need to see in splunk the raw data the info in different order:

Example

original syslog

(?<field1>REGEX),(?<field2>REGEX),(?<field3>REGEX), etc.......

what I want to see indexed in splunk

(?<field1>REGEX),(?<field3>REGEX),,(?<TIMESTAP>REGEX),(?<field2>REGEX).

I tried with SED command in props.conf is really useful to clean the data but not to reorder the info.

Thanks in advance

Alex

Re: rebuild a syslog event

scelikok — Wed, 28 Feb 2024 04:56:13 GMT

Hi @asabatini,

You can reorder or modify raw data using transforms, you need to capture parts of the messages and reorder them like $1$3$2, etc.

please see the document below;

https://docs.splunk.com/Documentation/Splunk/9.0.3/Data/Anonymizedata#Configure_the_transforms.conf_file

Re: rebuild a syslog event

asabatini — Wed, 28 Feb 2024 11:56:13 GMT

Hi @scelikok

I agree with you, I would show you my props and transforms conf file

props.conf

[custom_syslog] transforms-rebuild = group1 SHOULD_LINEMERGE = false

Transforms

[group1] REGEX = (?<group1>.+\s\-\s\-\s\-\s).*.auditID.:.(?<group2>[\w-]+)..*requestURI.:.(?<group3>[^,]+).+username.:.(?<group4>[^,]+).+sourceIPs....(?<group5>\d+.\d+.\d+.\d+) FORMAT = group1::$1, group2::$2, group5::$3, group3::$4, group4::$5

Did I forget something in the conf files?

Regards

Alessandro

Re: rebuild a syslog event

scelikok — Fri, 01 Mar 2024 05:08:15 GMT

Hi @asabatini,

I think the problem is name-capturing groups in REGEX. Using name-capturing groups will already create a field without a FORMAT parameter.

You can try one of the below options;

Using name-capturing groups in REGEX;

[group1] REGEX = (?<group1>.+\s\-\s\-\s\-\s).*.auditID.:.(?<group2>[\w-]+)..*requestURI.:.(?<group4>[^,]+).+username.:.(?<group5>[^,]+).+sourceIPs....(?<group3>\d+.\d+.\d+.\d+)

Without name-capturing groups in REGEX;

[group1] REGEX = (.+\s\-\s\-\s\-\s).*.auditID.:.([\w-]+)..*requestURI.:.([^,]+).+username.:.([^,]+).+sourceIPs....(\d+.\d+.\d+.\d+) FORMAT = group1::$1, group2::$2, group5::$3, group3::$4, group4::$5

Re: rebuild a syslog event

PickleRick — Fri, 01 Mar 2024 11:48:32 GMT

Hi Alessandro.

If that's your actual copy-pasted excerpt from props.conf you have

transforms-rebuild = group1

instead of

TRANSFORMS-rebuild = group1

(yes, case does matter here)