https://community.splunk.com/t5/Getting-Data-In/configure-field-extractions-props-conf-transforms-conf-for/m-p/175791#M35286 <P>Which one ? There are several.</P> <P>Thank you <BR /> Markus</P> Sat, 09 May 2015 17:30:53 GMT huaraz 2015-05-09T17:30:53Z https://community.splunk.com/t5/Getting-Data-In/configure-field-extractions-props-conf-transforms-conf-for/m-p/175789#M35284 <P>Hi,</P> <P>How would I configure field extraction for syslog messages. I have for example the following in my syslog. </P> <P>Mar 04 21:38:33 opensuse13 su[2749]: (to root) markus on pts/0<BR /> Mar 04 21:38:33 opensuse13 su[2749]: pam_unix(su-l:session): session opened for user root by markus(uid=1000)<BR /> Mar 04 21:45:26 opensuse13 sftp-server[3130]: error: Unknown extended request "home-directory"<BR /> Mar 04 22:33:08 opensuse13 su[2749]: pam_unix(su-l:session): session closed for user root<BR /> Mar 13 22:18:51 opensuse13 sftp-server[39633]: error: Unknown extended request "home-directory"<BR /> Mar 21 13:06:14 opensuse13 su[898]: (to root) markus on pts/6<BR /> Mar 21 13:06:14 opensuse13 su[898]: pam_unix(su:session): session opened for user root by markus(uid=1000)<BR /> Mar 21 13:13:57 opensuse13 su[898]: pam_unix(su:session): session closed for user root<BR /> Mar 30 20:02:42 opensuse13 sshd[40536]: Received disconnect from 192.168.1.24: 11: disconnected by user<BR /> Mar 30 20:02:52 opensuse13 sshd[40577]: Received disconnect from 192.168.1.24: 11: disconnected by user<BR /> Mar 30 20:03:06 opensuse13 sshd[40616]: Received disconnect from 192.168.1.24: 11: disconnected by user</P> <P>I am thinking to use different regexs for field extraction depending on daemon. So I can run report on su (i.e. which user logged in as root and how often) on sshd ( .e.g. which user came from which client ips). </P> <P>Thank you<BR /> Markus</P> Mon, 28 Sep 2020 19:46:48 GMT https://community.splunk.com/t5/Getting-Data-In/configure-field-extractions-props-conf-transforms-conf-for/m-p/175789#M35284 huaraz 2020-09-28T19:46:48Z https://community.splunk.com/t5/Getting-Data-In/configure-field-extractions-props-conf-transforms-conf-for/m-p/175790#M35285 <P>Look at the Splunk for NIX add on at apps.splunk.com. It already has the extractions for syslog based Unix/Linux logs that you are trying to do right now. <BR /> Additionally, you can see numerous examples of the different knowledge objects used to break out sourcetypes based on regex patterns. </P> Sat, 09 May 2015 14:03:36 GMT https://community.splunk.com/t5/Getting-Data-In/configure-field-extractions-props-conf-transforms-conf-for/m-p/175790#M35285 esix_splunk 2015-05-09T14:03:36Z https://community.splunk.com/t5/Getting-Data-In/configure-field-extractions-props-conf-transforms-conf-for/m-p/175791#M35286 <P>Which one ? There are several.</P> <P>Thank you <BR /> Markus</P> Sat, 09 May 2015 17:30:53 GMT https://community.splunk.com/t5/Getting-Data-In/configure-field-extractions-props-conf-transforms-conf-for/m-p/175791#M35286 huaraz 2015-05-09T17:30:53Z