Syslog failed event to be viewed in a table format?

SanjeewaF3 — Tue, 04 Oct 2016 02:29:25 GMT

Hi all,

Just like to know how to convert this syslog log event to be viewed as a table format in Splunk? Guessing this needs be in a rex format similar to another splunk answer post that i saw but i am newbie in this area.

EG Syslog:
Oct 3 18:57:37 abc001234 sshd[12345678]: Failed password for invalid user usr123d from 11.22.33.44 port 66778 ssh2

So the table would be something like this
Date/time
Server (abc001234)
User (usr123d)
IP (11.22.33.44)
Port (66778)

Greatly appreciate your help in this! Thanks.

Re: Syslog failed event to be viewed in a table format?

mydog8it — Tue, 04 Oct 2016 18:49:34 GMT

Start with extracting the interesting fields, here is a link to some info:
http://docs.splunk.com/Splexicon:Fieldextraction

Then try a search something like:
Index=* sourcetype=syslog Failed | table _time Server User IP Port

Here is a link to some educaton videos as well: https://www.splunk.com/view/education-videos/SP-CAAAGB6
Try searching Youtube for some beginner videos also.

topic Re: Syslog failed event to be viewed in a table format? in Dashboards & Visualizations

Syslog failed event to be viewed in a table format?

Re: Syslog failed event to be viewed in a table format?