topic Re: n00b log file parsing question in Alerting

n00b log file parsing question

jaywv6299 — Tue, 03 Jul 2012 17:53:12 GMT

I searched the Answers and the boards, but not effectively. I am trying to have splunk alert when days are greater than 20 days after "Duraton:" below:

2012-07-03 12:43:36,996 DEBUG [SessionManager] Session is: SESSION ID:NET\riquez1@cn=2bbeecf-49e5-9112-b787178c710a,RDP:0 Username:net\riquez START_TIME:Mon Jul 02 08:01:23 CDT 2012 STATE:CONNECTED PROTOCOL:RDP Duration:31 day 4 hours 42 minutes S-1-5-21-776561741-1390067357-839522115-53455] ConnectionId:7574376A4FE72E03C03D1167E44 SecurityServerName:null User SID:S-1-5-21-776561741

Thanks in Advance.

Re: n00b log file parsing question

sdaniels — Tue, 03 Jul 2012 18:01:49 GMT

Splunk should automatically give you a field for Duration since it's a key value pair with a semi-colon separating it. Do you see this in the field discovery on the bottom left of the search screen?

Then create a search like this sourcetype=something | where Duration > 20. With that you can now create an alert for this condition. Depending on how often this occurs you'll want to choose a timeframe for your alert. Is it over the last month, week, day, hour etc, but that is configurable.

Re: n00b log file parsing question

jaywv6299 — Tue, 03 Jul 2012 18:06:09 GMT

I do not see it as a key value. But if it did, wouldn't it be everything after the :, I only want to do Duration > 20, but it would have days, hours, etc after it.

How do I extract the entry so it is only "31" so I can perform the gt action?

Re: n00b log file parsing question

sdaniels — Tue, 03 Jul 2012 18:10:17 GMT

To keep it simple use the field extractor. See link below, it will generate the regex for you. Enter several values like 31 etc from the raw events... and put them on seperate lines and then generate the regex, call the field what you want. Then perform the search using the new field.

http://docs.splunk.com/Documentation/Splunk/latest/User/InteractiveFieldExtractionExample

Re: n00b log file parsing question

lguinn2 — Tue, 03 Jul 2012 20:00:32 GMT

By default, Splunk only finds key-value pairs with an equal sign. If your data had

Duration=31

Then Splunk would automatically extract the duration field. But, as sdaniels suggested, you can use the Interactive Field Extractor to create a field, and then use the search as suggested.