topic Re: How to import data from file *.log from Active Directory to SPLUNK? in Getting Data In

How to import data from file *.log from Active Directory to SPLUNK?

mazurmateusz — Mon, 01 Jun 2015 10:52:12 GMT

Hello All,

After uploading Windows Active Directory data from file '.log' to SPLUNK, i recognized that all data is not parsed.

To be honest- data looks like trash 😕 (imported as a one big row_event)

Any advice how to parse data from log file to let's say format readable from SPLUNK?
Maybe you know some scripts or any other way to parse file with extension '.log' to SPLUNK.

thanks in advance,

Mateusz

Re: How to import data from file *.log from Active Directory to SPLUNK?

woodcock — Mon, 01 Jun 2015 13:39:06 GMT

Somebody probably redefined LINE_BREAKER in the global props.conf file (either $SPLUNK_HOME/etc/system/default/ or ${SPLUNK_HOME}/etc/system/local/). The right thing to do is to move his global-context configuration changes to an app (context) and then your stuff (and others in the future) will work as they should right out of the box. Short of that, create an app for your stuff (which you should really do anyway in $SPLUNK_HOME/etc/MyApp/default/props.conf) and put this line in it:

LINE_BREAKER = ([\r\n]+)

Read up on all this here:
http://docs.splunk.com/Documentation/Splunk/6.2.3/Data/Indexmulti-lineevents

Re: How to import data from file *.log from Active Directory to SPLUNK?

mazurmateusz — Tue, 02 Jun 2015 06:45:15 GMT

Thanks for answer - I'm going to check this and give back information.