topic Re: How to parse Radius log files into splunk? What the configuration required for props and transforms in Getting Data In

How to parse Radius log files into splunk? What the configuration required for props and transforms

alenseb — Thu, 30 Aug 2012 11:10:08 GMT

Following is the Radius log file format that i have got. Now i need only few of the fields from each instance. Also you can see that 2 instances are separated by a blank line.
So can anyone help with the configuration of prop.conf and transfroms.conf to get the desired output.

Tue Aug 7 00:00:00 2012
User-Name = "xxxxxxxx"
NAS-Port = xxxxxxxx
NAS-IP-Address = xxxxxxxxu
Framed-IP-Address = xxxxxxxx
Filter-Id = " xxxxxxxx "
Class = " xxxxxxxx "
NAS-Identifier = " xxxxxxxx "
Acct-Status-Type = xxxxxxxx
Acct-Delay-Time = 0
Acct-Session-Id = " xxxxxxxx "
Acct-Authentic = RADIUS
Event-Timestamp = 1344286800
NAS-Port-Type = Ethernet
Calling-Station-Id = " xxxxxxxx "
NAS-Port-Id = " xxxxxxxx "
Service-Type = Framed-User
Framed-Protocol = PPP
Acct-Link-Count = 0
RB-Agent-Circuit-Id = " xxxxxxxx "
DSLForum-Agent-Circuit-Id = " xxxxxxxx "
DSLForum-Access-Loop-Encapsulation = ""
Timestamp = 1344286800
OSC-Service-Identifier = "DSLUsers"
Proxy-State = OSC-Extended-Id=40682
Timestamp = 1344286800

Tue Aug 7 00:00:00 2012
User-Name = " xxxxxxxx "
NAS-Port = xxxxxxxx
NAS-IP-Address = xxxxxxxx
Framed-IP-Address = xxxxxxxx
Class = "44620232:04:"
NAS-Identifier = " xxxxxxxx "
Acct-Status-Type = Stop
Acct-Delay-Time = 0
Acct-Input-Octets = 6021
Acct-Output-Octets = 323749
Acct-Session-Id = " xxxxxxxx "
Acct-Authentic = RADIUS
Acct-Session-Time = 1348
Acct-Input-Packets = 53
Acct-Output-Packets = 3187
Acct-Terminate-Cause = User-Request
Acct-Input-Gigawords = 0
Acct-Output-Gigawords = 0
Event-Timestamp = 1344286800
NAS-Port-Type = Ethernet
Calling-Station-Id = " xxxxxxxx "
NAS-Port-Id = " xxxxxxxx "
Service-Type = Framed-User
Framed-Protocol = PPP
Acct-Link-Count = 0
Timestamp = 1344286800
OSC-Service-Identifier = "DSLUsers"
Proxy-State = OSC-Extended-Id=24386
Timestamp = 1344286800

Thanks!!

Re: How to parse Radius log files into splunk? What the configuration required for props and transforms

lguinn2 — Mon, 03 Sep 2012 00:13:46 GMT

I think all you need is props.conf - and frankly, I think that the Splunk default settings would work just fine.
Splunk will automatically extract all the fields, as they are in name=value format. But here is a stanza for props.conf that should work as well. Note that this assumes that you set sourcetype=radius in the inputs.conf

And these props.conf entries belong on the indexer (or wherever the events are being parsed).

[radius]
SHOULD_LINEMERGE = true
BREAK_ONLY_BEFORE_DATE = true
TIME_FORMAT = %A %B %d %H:%M:%S %Y

Re: How to parse Radius log files into splunk? What the configuration required for props and transforms

alenseb — Mon, 28 Sep 2020 12:22:08 GMT

Thanks for the input!!

You can also try the following code, It works as well

SHOULD_LINEMERGE = true
REPORT-vievents = vievents_extractions
BREAK_ONLY_BEFORE = ^(Sun|Mon|Tue|Wed|Thu|Fri|Sat)

Re: How to parse Radius log files into splunk? What the configuration required for props and transforms

beatus — Tue, 29 Sep 2020 13:31:15 GMT

alenseb,
You should avoid the use of SHOULD_LINEMERGE = true and any break_before or break_after parameters. They're not required to do linebreaking correctly in almost all cases. Here's what should work for you:

[radius]
SHOULD_LINEMERGE = false
TIME_FORMAT = %A %B %d %H:%M:%S %Y
TIME_PREFIX = ^
MAX_TIMESTAMP_LOOKAHEAD = 40
LINE_BREAKER = ([\r\n]+)\w{3}\s+\w{3}\s+\d{1,2}\s+\d{2}:\d{2}:\d{2}\s+\d{4}
TRUNCATE = 99999

Re: How to parse Radius log files into splunk? What the configuration required for props and transforms

sudoritz — Tue, 04 Apr 2017 00:08:16 GMT

Thanks That WORKS 🙂