topic Re: How can I parse bacticks/grave accents (`) in syslog? in Getting Data In

How can I parse bacticks/grave accents (`) in syslog?

cleartext — Wed, 01 Apr 2015 02:03:35 GMT

Hi,

I have a log that separate using Grave Accent

3`0`1`1`1dk3ad`1020`20140301`10:53:37`1`17`140219185904`172.3.196.184`58493`204.126.63.2`53`eth5`eth6`````````````\xB3\xBB\xBA\xCE`\xBFܺ\xCE`44`N/A`4````
3`0`1`1`1dk3ad`1020`20140301`10:45:53`1`17`140124184856`192.11.2.125`65226`204.124.101.2`53`eth0`eth1`SNAT`172.3.196.240`65226``````````\xB3\xBB\xBA\xCE`\xBFܺ\xCE`43`IB_NAT:12`4````

How can I parse this log?

add ` in segmenters.conf ?

or regex?

Re: How can I parse bacticks/grave accents (`) in syslog?

tonykung — Wed, 01 Apr 2015 17:20:12 GMT

what i would do is to format the log before forwarding to splunk. even you can successfully submit it , you will face trouble when querying.

Re: How can I parse bacticks/grave accents (`) in syslog?

woodcock — Mon, 10 Aug 2015 04:52:11 GMT

There is no reason to change segmenters.conf because it should already be segmenting along your data elements because the graves will create segment breaks (being that they are punctuation marks). You should be able to use any of the RegEx-based options for field extractions with no problems. For example, you can use rex like this:

... | rex field=raw "(?<field1>[^`]+)`(?<field2>[^`]+)`(?<field3>[^`]+)`(?<field5>[^`]+)`"