parsing _internal logs

JohnEGones — Tue, 03 Oct 2023 11:58:10 GMT

Hi Fellow Splunkers,

Have a hopefully quick question:

Want to pull out the source and host from the Windows _internal splunk logs, but my rex (cribbed from a post on here) isn't working.

index=_internal host IN (spfrd1, spfrd2) source="*\\Splunk\\var\\log\\splunk\\splunkd.log" component=DateParserVerbose | rex "Context: source=(?P<sourcetypeissue>\w+)\Shost=(?P<sourcehost>\w+)" | stats list(sourcetypeissue) as file_name list(sourcehost)

But I get no stats, my events look like this:

08-24-2022 07:50:20.383 -0400 WARN DateParserVerbose - Failed to parse timestamp in first MAX_TIMESTAMP_LOOKAHEAD (128) characters of event. Defaulting to timestamp of previous event (Sun Aug 24 07:49:58 2022). Context: source::WMI:WinEventLog:Security|host::SPFRD1|WMI:WinEventLog:Security|1

Re: parsing _internal logs

ITWhisperer — Tue, 03 Oct 2023 12:14:53 GMT

Try it like this

| rex "Context: source::(?P<sourcetypeissue>\w+)\Shost::(?P<sourcehost>\w+)"

Re: parsing _internal logs

JohnEGones — Tue, 03 Oct 2023 12:24:50 GMT

ITWhisperer,

Yeah that doesn't work but now I realize its because there is a file path reference:

source::X:\logs\[some IP]\log123.txt|host::[host]

topic Re: parsing _internal logs in Splunk Search

parsing _internal logs

Re: parsing _internal logs

Re: parsing _internal logs