https://community.splunk.com/t5/Getting-Data-In/How-can-we-parse-syslogs/m-p/204095#M40282 <P>We have log files which contain syslogs, such as -<BR /> -- Jun 8 11:04:26 PRD_DMZ_004_XXXX-PROD-XXXAPP [0x810002d4][cli][error] trans(1582882743): TCP connection to "xx.xxx.xxx.xxx port 443" failed (connection refused)</P> <P>On the UI, it's pretty gloomy as no fields are being parsed. What can we do?</P> <P>For one thing, I'm not even sure whether these log files conform to the "standard" syslog syntax...</P> Tue, 29 Sep 2020 09:55:01 GMT ddrillic 2020-09-29T09:55:01Z https://community.splunk.com/t5/Getting-Data-In/How-can-we-parse-syslogs/m-p/204095#M40282 <P>We have log files which contain syslogs, such as -<BR /> -- Jun 8 11:04:26 PRD_DMZ_004_XXXX-PROD-XXXAPP [0x810002d4][cli][error] trans(1582882743): TCP connection to "xx.xxx.xxx.xxx port 443" failed (connection refused)</P> <P>On the UI, it's pretty gloomy as no fields are being parsed. What can we do?</P> <P>For one thing, I'm not even sure whether these log files conform to the "standard" syslog syntax...</P> Tue, 29 Sep 2020 09:55:01 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-we-parse-syslogs/m-p/204095#M40282 ddrillic 2020-09-29T09:55:01Z https://community.splunk.com/t5/Getting-Data-In/How-can-we-parse-syslogs/m-p/204096#M40283 <P>Simplest would be to use a <A href="http://docs.splunk.com/Documentation/Splunk/6.4.1/Data/Listofpretrainedsourcetypes">pretrained sourcetypes</A>. But not all formats are pretrained. If yours is not, you can use IFX or write your own regex to extract the fields.</P> Wed, 08 Jun 2016 18:41:40 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-we-parse-syslogs/m-p/204096#M40283 sundareshr 2016-06-08T18:41:40Z https://community.splunk.com/t5/Getting-Data-In/How-can-we-parse-syslogs/m-p/204097#M40284 <P>Sounds great. Much appreciated. </P> Wed, 08 Jun 2016 19:11:09 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-we-parse-syslogs/m-p/204097#M40284 ddrillic 2016-06-08T19:11:09Z