Field extraction from alerts

[DawidM]

Hi. I have a task to extract all fields from raw logs used by our alerts and I wonder if there is an automated way to do it, or I have to go manually through each alert to check what fields are used? All help is really appreciated

[richgalloway]

It depends.  What tool is producing the alerts?  In what format are they?

Splunk will automatically extract fields in key=value format.  Other formats are supported if the correct sourcetype is specified, but we need more information.  Can you share some sample alerts (sanitized, of course)?

[DawidM]

We have logs from firewalls and web applications. What I need is to extract field names that are used by our alerts (queries) to compare the, with the fields used by a different team and tools.

[richgalloway]

Check splunkbase (https://apps.splunk.com) for add-ons that will help you ingest the data from your firewalls and applications. Changes are they comply with the Common Information Model so the field names are well-known.