topic Re: Field extraction from simple one-sentense log in Getting Data In

Field extraction from simple one-sentense log

user2020dy — Thu, 08 Oct 2020 10:21:44 GMT

Can anybody help me to create props.conf and transforms.conf files to correctly parse such logs?

"2020-10-08 09:35:56","Department1","Department2","113.8.10.134","113.8.10.132","Allowed","1 (A)","NOERROR","ant.com.","Search Engines","Networks","Networks",""

"2020-10-08 09:35:56","Department1","Department2","113.8.10.134","113.8.10.132","Allowed","1 (A)","NOERROR","ant.com.","Search Engines,Malware","Networks","Networks",""

"2020-10-08 09:35:56","Department1","Department2","113.8.10.134","113.8.10.132","Allowed","1 (A)","NOERROR","ant.com.","Search Engines,Malware, Network","Networks","Networks",""

"2020-10-08 09:35:56","Department1","Department2","113.8.10.134","113.8.10.132","Allowed","1 (A)","NOERROR","ant.com.","Malware","Networks","Networks",""

As you see, here the log with the category field "Search Engines,Malware" should belong to both categories: Search Engines and Malware. So, the category field can consist of 1, 2, 3 or more values.

Re: Field extraction from simple one-sentense log

493669 — Thu, 08 Oct 2020 10:31:20 GMT

@user2020dy try like below-
props.conf -

[sourcetype_name] LINE_BREAKER = ([\r\n]+) SHOULD_LINEMERGE = false category = Custom TIME_PREFIX = ^\" MAX_TIMESTAMP_LOOKAHEAD = 30 TIME_FORMAT = %Y-%m-%d %H:%M:%S REPORT-main = parse

transforms.conf -

[parse] DELIMS = "," FIELDS = Time,field1,field2,field3,field4,field5,field6,field7,field8,field9,field10,field11,field12,field13

Let me know if it helps! and upvote will be appreciated

Re: Field extraction from simple one-sentense log

user2020dy — Thu, 08 Oct 2020 12:20:39 GMT

thank you, it helps to parse most logs, but the field category can contain 2 or 3 values

Can you prompt how to delimeter these values?

Re: Field extraction from simple one-sentense log

493669 — Thu, 08 Oct 2020 14:21:59 GMT

you can use rex command to separate values within category.