topic Field extraction from alerts in Alerting

Field extraction from alerts

DawidM — Wed, 10 Jun 2020 12:55:26 GMT

Hi. I have a task to extract all fields from raw logs used by our alerts and I wonder if there is an automated way to do it, or I have to go manually through each alert to check what fields are used? All help is really appreciated

Re: Field extraction from alerts

richgalloway — Wed, 10 Jun 2020 12:55:00 GMT

It depends. What tool is producing the alerts? In what format are they?

Splunk will automatically extract fields in key=value format. Other formats are supported if the correct sourcetype is specified, but we need more information. Can you share some sample alerts (sanitized, of course)?

Re: Field extraction from alerts

DawidM — Mon, 15 Jun 2020 13:27:40 GMT

We have logs from firewalls and web applications. What I need is to extract field names that are used by our alerts (queries) to compare the, with the fields used by a different team and tools.

Re: Field extraction from alerts

richgalloway — Mon, 15 Jun 2020 14:01:01 GMT

Check splunkbase (https://apps.splunk.com) for add-ons that will help you ingest the data from your firewalls and applications. Changes are they comply with the Common Information Model so the field names are well-known.