topic Re: Log transformation in Splunk Search

Log transformation

srajanbabu — Tue, 19 Nov 2013 12:43:11 GMT

I have below requirement, some one Please guide how do I achieve using Splunk

I have host called SourceHost where log files are generated and I have another host called TargetHost where I have to transform the source log and write.

Source log
SNM5 YAHOO3SN.#### :: 03/03/13 00:00:07 :: B ::User yahoo3sn logged in
SNM4 YAHOO3SN.871F :: 03/03/13 00:00:07 :: S ::User logged off, Processing will begin

Target log
Buy | 13/03/03 | YAHOO3SN |03/03/13 00:00:07 | User yahoo3sn logged in
Sell | 13/03/03 | SNM4 |03/03/13 00:00:07 | logged off, Processing will begin

where
1. B stands for buy and S stand for sell
2. Soruce date is mm/dd/yy and target date is yy/mm/dd
3. if third word in the log is "####" then pickup the second word otherwise pickup the first word.

Re: Log transformation

richgalloway — Tue, 19 Nov 2013 13:01:47 GMT

Something like this should do the job.

Re: Log transformation

srajanbabu — Tue, 19 Nov 2013 13:18:29 GMT

Thanks for the swift response, however I have few concerns.
I assume, this regex will be performed on indexed file, I would like this tranformation happend as I read the input file and If possible i want to tranfer the data to target host without a footprint in splunk server.

Re: Log transformation

richgalloway — Tue, 19 Nov 2013 13:52:20 GMT

You won't be able to have Splunk process the log without indexing it. You should be able to make the transformation happen on input by adding a similar REGEX statement to your transforms.conf file.