https://community.splunk.com/t5/Splunk-Search/Field-Extraction-from-vcenter-sshd-logs/m-p/536281#M151885 <P>Hi team, I would like to extract the following fields from vcenter logs that are being sent to Splunk on a dedicated port.</P><P>Sample log as below:</P><P>2021-01-18T06:21:11.752139+00:00 test101 sshd[21656] Accepted password for root from 76.87.981.72 port 49881 ssh2</P><P>I am already using the Splunk_TA_vcenter from splunk_add_on_from_vmware but no luck in extraction.</P><P>Need to extract the following fields:</P><P>Field name&nbsp; &nbsp; Field value</P><P>app&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sshd</P><P>user&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;root</P><P>src_ip&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;76.87.981.72</P><P>dest&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;test101</P><P>action&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;success</P><P>tag&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; authentication&nbsp;</P><P>thanks in advance.</P> Tue, 19 Jan 2021 04:54:37 GMT santosh_scb 2021-01-19T04:54:37Z https://community.splunk.com/t5/Splunk-Search/Field-Extraction-from-vcenter-sshd-logs/m-p/536281#M151885 <P>Hi team, I would like to extract the following fields from vcenter logs that are being sent to Splunk on a dedicated port.</P><P>Sample log as below:</P><P>2021-01-18T06:21:11.752139+00:00 test101 sshd[21656] Accepted password for root from 76.87.981.72 port 49881 ssh2</P><P>I am already using the Splunk_TA_vcenter from splunk_add_on_from_vmware but no luck in extraction.</P><P>Need to extract the following fields:</P><P>Field name&nbsp; &nbsp; Field value</P><P>app&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sshd</P><P>user&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;root</P><P>src_ip&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;76.87.981.72</P><P>dest&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;test101</P><P>action&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;success</P><P>tag&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; authentication&nbsp;</P><P>thanks in advance.</P> Tue, 19 Jan 2021 04:54:37 GMT https://community.splunk.com/t5/Splunk-Search/Field-Extraction-from-vcenter-sshd-logs/m-p/536281#M151885 santosh_scb 2021-01-19T04:54:37Z