topic Re: Remove DHCP Header in Getting Data In

Remove DHCP Header

simuvid — Fri, 23 Jul 2010 20:33:58 GMT

Hi folks,

as DHCP logfiles contain huge headers, with always the same information, i will remove them, befor indexing the log events.

Any idea how to do that?

Cheers,

Christian

Re: Remove DHCP Header

parallaxed — Tue, 27 Jul 2010 01:10:47 GMT

You'll need to do a couple of things.

Firstly, partition your DHCP data into two events as best you can - separating the salient data from the repeating headers. You can do this by setting the right LINE_BREAKER/MUST_BREAK_AFTER/BREAK_ONLY_BEFORE in props.conf

http://www.splunk.com/base/Documentation/4.1/Admin/Propsconf

You then need to discard the trash event by sending it to the nullQueue, as described here:

http://www.splunk.com/base/Documentation/4.1.4/Admin/Routeandfilterdata

Re: Remove DHCP Header

simuvid — Tue, 27 Jul 2010 19:08:37 GMT

Thanks for the help!

Here is what I did;

Changes to transforms.conf:

[AutoHeader-DhcpLog]
FIELDS="ID","Date","Time","Description","IP Address","Host Name","MAC Address"
DELIMS=","

#Delete all events that are not filtered with following statement
[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

#Filter all Events that starts with an ID, Date and Time and send them to the index queue
[setparsing]
REGEX = \d\d\,\d\d\/\d\d\/\d\d\,\d\d\:\d\d\:\d\d
DEST_KEY = queue

FORMAT = indexQueue

Changes to props.conf:
[DhcpLog]
CHECK_FOR_HEADER = TRUE
BREAK_ONLY_BEFORE = \d\d\,\d\d\/\d\d\/\d\d\,\d\d\:\d\d\:\d\d
REPORT-AutoHeader = AutoHeader-DhcpLog
TRANSFORMS-set= setnull,setparsing

Just in case somebody can use it! 🙂

Happy Splunking!