topic props.conf for specific log format in Splunk Search

props.conf for specific log format

_gkollias — Mon, 28 Sep 2020 16:02:11 GMT

Hi All,

I'd like to create a props.conf for log files in this format:

   DEBUG[ScriptingSession] 2013-11-30 15:52:40.869 EST: <-initialize

Here is what I have so far:

[mws_debug]
SHOULD_LINEMERGE = false
TIME_PREFIX = ^
TIME_FORMAT=%Y-%m-%d $H:%M:%S.%3N
MAX_TIMESTAMP_LOOKAHEAD = 50
EXTRACT-mws_debug = "(?[^"]+)","(?[^"]+)","(?[^"]+)"

I think the field extraction is off, but I can't seem to get this to work.

Your help in modifying this stanza will be much appreciated.

Thanks!

Re: props.conf for specific log format

martin_mueller — Tue, 04 Mar 2014 16:57:05 GMT

The field extraction indeed is off - I don't see any double quotes in the event, but your extraction is full of them.

Does event breaking and timestamping work for you?

Re: props.conf for specific log format

_gkollias — Tue, 04 Mar 2014 18:38:51 GMT

I would like to use this format if possible.

Re: props.conf for specific log format

lguinn2 — Wed, 05 Mar 2014 06:55:19 GMT

Here is a correct regular expression; as Martin pointed out, it was full of double quotes and was not a valid regex. You should not quote your regular expression, nor should it have internal quotes. I have corrected a few other settings as well.

[mws_debug]
SHOULD_LINEMERGE = false
TIME_PREFIX = \]
TIME_FORMAT=%Y-%m-%d $H:%M:%S.%3N
MAX_TIMESTAMP_LOOKAHEAD = 50
EXTRACT-mws=(?<debug>\S+)\[(?<session>\S+)\]\s+\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}\.\d+\s(?<status>.*)

Re: props.conf for specific log format

lguinn2 — Wed, 05 Mar 2014 06:56:13 GMT

Note that the extraction is broken into two lines in the post above, but it must be on a single line in your props.conf