topic How to change IDS logs to JSON format and index in Splunk? in Getting Data In

How to change IDS logs to JSON format and index in Splunk?

hermyphang — Mon, 28 Sep 2020 17:30:00 GMT

Hi, I trying to index ids logs into splunk server however the log is not in good format.
How can i reformat the log into json so it will have table for timestamp, event type, src ip, and the rest.
I have try to edit props.conf but still the same.
Anything should I do get this work.
Thanks.

[suricata]
KV_MODE = json
NO_BINARY_CHECK = 1
TRUNCATE = 0

Here my log in splunk server

Aug 3 23:59:45 192.168.1.200 Aug 3 23:59:43 IDS suricata: {"timestamp":"2014-08-03T23:59:43.946222","event_type":"alert","src_ip":"192.168.20.1","src_port":6000,"dest_ip":"8.8.8.8","dest_port":22,"proto":"TCP","alert":{"action":"allowed","gid":1,"signature_id":2001219,"rev":18,"signature":"ET SCAN Potential SSH Scan","category":"Attempted Information Leak","severity":2}}

Re: How to change IDS logs to JSON format and index in Splunk?

MuS — Sat, 06 Sep 2014 06:17:33 GMT

Hi hermyphang,

KV_MODE in props.conf is only for search-time field extraction not index-time:

KV_MODE = [none|auto|auto_escaped|multi|json|xml]
 * Used for search-time field extractions only.

Also bear in mind, that the log format must be correct JSON and not some semi-fake JSON like log - you can check the format here

Use the TRANSFORMS field extraction type to create index-time field extractions.

NOTE: Index-time field extractions have performance implications. Creating additions to
Splunk's default set of indexed fields is ONLY recommended in specific circumstances.

Whenever possible, extract fields only at search time.

hope that helps ...

cheers, MuS