Alerting

How would I set up Syntax highlighted for a log file?

uchoavaz
Explorer

Hello!

I have a log file with the following pattern:

 

 

 

 

13:06:03 CRITICAL  [app] An error happened while processing message active/mastercard/event/secondpresentmentcreateevent/v1/2022/08/30/afae9068-8dc2-5e3a-9e4a-83081925238f ["message" => "[{"requestid":"49120180-f64d-863d-f7f5-c2f58b180587","source":"SYSTEM","reasoncode":"INVALID_REQUEST","description":" [CreateCR2] usecase is not applicable in this context.","recoverable":false,"details":[{"name":"ErrorDetailCode","value":"100001"}]}]","status" => 400,"trace" => [["file" => "/var/www/drm-scheme/vendor/react/event-loop/src/Timer/Timers.php","line" => 101,"function" => "App\Command\{closure}","class" => "App\Command\AbstractQueueProcessor","type" => "->"],["file" => "/var/www/drm-scheme/vendor/react/event-loop/src/StreamSelectLoop.php","line" => 185,"function" => "tick","class" => "React\EventLoop\Timer\Timers","type" => "->"],["file" => "/var/www/drm-scheme/src/AppBundle/Command/AbstractQueueProcessor.php","line" => 311,"function" => "run","class" => "React\EventLoop\StreamSelectLoop","type" => "->"],["file" => "/var/www/drm-scheme/vendor/symfony/console/Command/Command.php","line" => 255,"function" => "execute","class" => "App\Command\AbstractQueueProcessor","type" => "->"],["file" => "/var/www/drm-scheme/vendor/symfony/console/Application.php","line" => 929,"function" => "run","class" => "Symfony\Component\Console\Command\Command","type" => "->"],["file" => "/var/www/drm-scheme/vendor/symfony/framework-bundle/Console/Application.php","line" => 96,"function" => "doRunCommand","class" => "Symfony\Component\Console\Application","type" => "->"],["file" => "/var/www/drm-scheme/vendor/symfony/console/Application.php","line" => 264,"function" => "doRunCommand","class" => "Symfony\Bundle\FrameworkBundle\Console\Application","type" => "->"],["file" => "/var/www/drm-scheme/vendor/symfony/framework-bundle/Console/Application.php","line" => 82,"function" => "doRun","class" => "Symfony\Component\Console\Application","type" => "->"],["file" => "/var/www/drm-scheme/vendor/symfony/console/Application.php","line" => 140,"function" => "doRun","class" => "Symfony\Bundle\FrameworkBundle\Console\Application","type" => "->"],["file" => "/var/www/drm-scheme/bin/console","line" => 42,"function" => "run","class" => "Symfony\Component\Console\Application","type" => "->"]],"line" => 261,"class" => "App\Command\AbstractQueueProcessor","request" => "active/mastercard/request/secondpresentmentrequest/v1/2022/08/29/204618304273/cb905322-b2ab-4742-8acd-a7915b9be744","caseId" => "204618304273"] ["uid" => "31473ed"]

 

 

 

 

 

But i need to understand how can i set up in the Settings -> Source types -> (sourcetype name create) to make this event highlighted. Here is how i tried to set up (but didn't work):
Captura de Tela 2022-09-22 às 10.29.00 AM.png

 

Tags (1)
0 Karma

uchoavaz
Explorer

I will give you an example... This json event i could set up the highlight
Captura de Tela 2022-09-22 às 11.39.58 AM.png

 

The raw text is:

{"message":"Nothing to process in worldpay-prd-scheme-event-store-queue-dlq","context":[],"level":200,"level_name":"INFO","channel":"app","datetime":{"date":"2022-08-30 13:06:13.999247","timezone_type":3,"timezone":"UTC"},"extra":{"uid":"e527f53"}}

 

the sourcetype setup is:

Captura de Tela 2022-09-22 às 11.41.06 AM.png

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @uchoavaz,

no this is possible only for json format, not for raw text.

ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @uchoavaz,

could you better describe what do you mean with "highlighted"?

In a sourcetype you define many things: format, fields, aliases, etc... but there isn't the possibility to highlight a parte of an event.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...