topic Re: Help On Building source type in Getting Data In

Help On Building source type

Prakash493 — Wed, 03 Jul 2019 14:58:29 GMT

Hi , i have the below sample log and the log is not parsing and i am not able to build the sourcetype , is any one can help me to build the sourcetype for below sample log:

1/17/2018 22:21:0:278 pid: shutting down
1/17/2018 22:21:5:284 pid: shutting down
1/17/2018 22:21:10:367 pid: shutting down
1/17/2018 22:23:50:84 pid:205c145f-22a2-dcd4-3a65-d8dfa35d49e4 Current Page: "Log In"
1/17/2018 22:23:50:84 pid:205c145f-22a2-dcd4-3a65-d8dfa35d49e4 at 2fa login page!
1/17/2018 22:23:50:380 pid:205c145f-22a2-dcd4-3a65-d8dfa35d49e4 Waiting for human intervention
1/17/2018 22:23:50:381 pid:205c145f-22a2-dcd4-3a65-d8dfa35d49e4 On 2fa login page, logging in...
2/6/2018 23:57:44:395 pid:e3db867b-2642-061f-fc11-2294be178db6 shutting down
2/6/2018 23:58:9:41 pid: connection failure! msg
2/6/2018 23:58:14:24 pid: connection failure! msg
2/6/2018 23:58:19:47 pid: connection failure! msg

Re: Help On Building source type

richgalloway — Wed, 03 Jul 2019 15:07:10 GMT

Have you tried the Add Data wizard? It will guide you through the steps of adding a sourcetype.

Re: Help On Building source type

Prakash493 — Wed, 03 Jul 2019 15:08:59 GMT

yes i tried the add data wizard when i go though it , looks good but throwing errors like its combining multiple events into one

Re: Help On Building source type

amitm05 — Wed, 03 Jul 2019 15:13:09 GMT

Do you know what is the source of these logs ? If yes, try to see in the Add data wizard if you see that log type already supported in Splunk. However if the logs do not have a default support in Splunk, you'll have to provide the linebreaking and Time stamp recognition criteria.

Re: Help On Building source type

richgalloway — Wed, 03 Jul 2019 18:02:19 GMT

In the Add Data wizard, load your file, click Next then click on Advanced. Click on "New Setting" and enter "TIME_FORMAT" in the new Name box and "%m/%d/%Y %H:%M:%S:%3N" in the new Value box. Click "Apply settings" and see if it helps.

Re: Help On Building source type

woodcock — Thu, 04 Jul 2019 00:29:14 GMT

Another vote for Add Data Wizard.

Re: Help On Building source type

Azeemering — Wed, 30 Sep 2020 01:14:16 GMT

This will work as a minimum props:

[your_sourcetype]
SHOULD_LINEMERGE=true
LINE_BREAKER=([\r\n]+)
NO_BINARY_CHECK=true
TIME_FORMAT=%m/%d/%Y %H:%M:%S:%3N
TIME_PREFIX=^
MAX_TIMESTAMP_LOOKAHEAD=21

Re: Help On Building source type

Prakash493 — Sat, 06 Jul 2019 01:10:01 GMT

Thanks Azeem , It worked and my logs looks good now.