topic Creating Splunk App to parse syslogs in Getting Data In

Creating Splunk App to parse syslogs

hm222jy — Wed, 03 Mar 2021 13:21:54 GMT

I would like to find a detaild tutorial on how to create a splunk app to parse syslogs, with pre-defined field names, not the automatic key/value that splunk is able to detect.

I have syslogs with different log types, I wonder if there is some documentation/tutorial on this. Can anyone point in the right direction? I am new to splunk. Thanks.

Re: Creating Splunk App to parse syslogs

gcusello — Wed, 03 Mar 2021 14:17:57 GMT

Hi @hm222jy,

to do this you have the following items:

identify each type pf syslog fpr your flows,
group all the one with the same structure,
create a sourcetype for each type defining the specifications of each one:
- event breaks,
- timestamp,
- field extractions,
- eventtypes,
- tags,
- aliases,
- fields calculations.
eventually check the CIM compliance of your sourcetypes.

all these configurations will be in props.conf and transforms.conf files that you can put in one or more Technical Add-Ons (TAs).

You can find documentazione about this in:

https://docs.splunk.com/Documentation/Splunk/8.1.2/Data/WhatSplunkcanmonitor

https://docs.splunk.com/Documentation/Splunk/8.1.2/Admin/Configurationparametersandthedatapipeline

https://docs.splunk.com/Documentation/CIM/4.18.0/User/Overview

Ciao.

Giuseppe

Re: Creating Splunk App to parse syslogs

hm222jy — Wed, 03 Mar 2021 15:19:18 GMT

Grazie Giuseppe. The documentation sometimes is hard to digest for newbies but will try to go through it.

Re: Creating Splunk App to parse syslogs

gcusello — Wed, 03 Mar 2021 15:23:20 GMT

Hi @hm222jy,

try to have the documentation of the Admin Training, or (better) follow this training.

It's also useful to follow the Sales Engineers I and II Training Courses, where log ingestion is described .

Ciao and happy splunking.

Giuseppe