topic Re: Why does the Ping audit format break with props? in Monitoring Splunk

Why does the Ping audit format break with props?

ddrillic — Fri, 19 Apr 2019 20:09:39 GMT

The audit file has this format -

# 18/Apr/2019:14:59:38.341 -0500; ....
dn: dc=....
changetype: modify
replace: ds-sync-state
ds-sync-state: .....

# 18/Apr/2019:15:01:32.404 -0500; ....
dn: uid=Testing123,....
changetype: delete

# 18/Apr/2019:15:01:33.352 -0500; ....
dn: dc=....
changetype: modify
replace: ds-sync-state
ds-sync-state: .....

In props.conf I have -

[ldap:....]
disabled=false
SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n]+)\#\s+\S+
TIME_FORMAT=%d/%b/%Y:%H:%M:%S.%3N %z
TIME_PREFIX=^\#\s+
MAX_TIMESTAMP_LOOKAHEAD=50
TRUNCATE=10000

The parsing doesn't always work and I end up with events with multiple lines such as -

# 18/Apr/2019:14:59:38.341 -0500; ....

This line should be only the starting line of each event.

What am I missing?

Re: Why does the Ping audit format break with props?

somesoni2 — Fri, 19 Apr 2019 20:43:20 GMT

Give this a try

[ldap:....]
 disabled=false
 SHOULD_LINEMERGE=false
 LINE_BREAKER=([\r\n]+)(?=\s*\#\s+\d+\/\w+)
 TIME_FORMAT=%d/%b/%Y:%H:%M:%S.%3N %z
 TIME_PREFIX=^\s*#\s+
 MAX_TIMESTAMP_LOOKAHEAD=30
 TRUNCATE=10000

Re: Why does the Ping audit format break with props?

ddrillic — Mon, 22 Apr 2019 15:00:06 GMT

Gorgeous @somesoni2 - what might have gone wrong with the original props set up? Does _internal capture incorrect set-ups, like my original one?

Re: Why does the Ping audit format break with props?

somesoni2 — Mon, 22 Apr 2019 15:14:19 GMT

Main change I did was to update LINE_BREAKER to handle possible spaces before # in the raw data. Again, unless there is a syntax error, all regex are valid for Splunk and you'll not see any error (Splunk can't decide if you want to merge those events or not).

Re: Why does the Ping audit format break with props?

ddrillic — Mon, 22 Apr 2019 15:37:22 GMT

Perfect - makes sense.