topic Re: Question about not standard source type in Splunk Search

Question about not standard source type

glm_cybaze — Wed, 30 Sep 2020 05:25:49 GMT

Hi to all, I'm new to the splunk use and I have an issue with a software that write logs in a non standard way (of my fresh knowledge of splunk)
{

"name":"clientLogger",
"level":30,
"levelName":"info",
"msg":"[audio] iceServers",
"time":"2018-08-27T19:32:57.389Z",
"src":"xxxxxx",
"v":1,
"extraInfo":{

"sessionToken":"e7boenucj1pwkbfc",
"meetingId":"183f0bf3a0982a127bdb8161e0c44eb696b3e75c-1535398242909",
"requesterUserId":"w_klfavdlkumj8",
"fullname":"Ios",
"confname":"Demo Meeting",
"externUserID":"w_klfavdlkumj8"
},
"url":"xxxx",
"userAgent":"Mozilla/5.0",
"count":1
}
and in splunk the log are:

the only info I need are:
- time
- fullname
- confname

But regex don't work and I don't recognize how to set only the proper field!
Some help or how to guide would be helpful!
Thanks in advance!

Re: Question about not standard source type

richgalloway — Sat, 16 May 2020 16:59:41 GMT

rex should work. You didn't say what you tried, so we can't say what you might have done wrong. Try this:

index=foo
| rex "time\":\"(?<time>[^\"]+)"
| rex "fullname\":\"(?<fullname>[^\"]+)"
| rex "confname\":\"(?<confname>[^\"]+)"
| table time, fullname, confname

Re: Question about not standard source type

glm_cybaze — Sat, 16 May 2020 23:27:01 GMT

Thanks, i used in search and work! created report and dashboard! now i try to replicate and add more complex analisys!

Re: Question about not standard source type

to4kawa — Sat, 16 May 2020 23:35:41 GMT

make props.conf

SEDCMD-trim = s/.*?\]//g
TRUNCATE = 0
INDEXED_EXTRACTION = none
KV_MODE = json
SHOULD_LINEMERGE = false

You can see the fields {}.time , extraInfo{}.fullname and extraInfo{}.confname

Re: Question about not standard source type

richgalloway — Sat, 16 May 2020 23:58:26 GMT

If your problem is resolved then please accept an answer to help future readers.

Re: Question about not standard source type

glm_cybaze — Sun, 17 May 2020 04:29:48 GMT

Will try this solution too!
Thanks