All Apps and Add-ons
Highlighted

Multiline Event Import Problems - UNCLE!

New Member

I’m new to Splunk as well. This seemed like it would be straightforward, but…
I have a multiline extract from a data source. The fields are well defined but I can’t carve the fields and related data into columns within Splunk. Data example:

Row 1:
Request ID: 0x1
Requester Name: "DUDE\PKI-TEST$"
Certificate Template: "SubCA"
Serial Number: "6111e953000000000005"
Certificate Effective Date: 12/21/2007 11:57 AM
Certificate Expiration Date: 12/17/2009 8:58 PM
Effective Revocation Date: EMPTY
Revocation Reason: EMPTY
User Principal Name: EMPTY
Request Distinguished Name: "CN=Issuer2048, DC=Bob, DC=Billy, DC=com”
…..
Row 6:
Request ID: 0x6
Requester Name: "Agent\TrustedAgent"
Certificate Template: "1.3.6.1.4.1.311.21.8.729503.12069660.16204964.16364598.2652628.198.1741112.16422776" Boeing Airline SSL Application
Serial Number: "611a4dd3000000000006"
Certificate Effective Date: 1/2/2008 5:12 PM
Certificate Expiration Date: 1/1/2009 5:12 PM
Effective Revocation Date: EMPTY
Revocation Reason: EMPTY
User Principal Name: EMPTY
Request Distinguished Name: "CN=APPL1 SSL, OU=Work Dev, O=BillyBobCo, L=Bellevue, S=WA., C=US”

For each line in the multiline event (from “Row” to “Row”) I need a column and related data.
I have used BREAKONLYBEFORE=Row and SHOULD_LINEMERGE=true to break the events up but I haven’t found a way to establish the rest of the event fields.

Any help will be greatly appreciated!

0 Karma
Highlighted

Re: Multiline Event Import Problems - UNCLE!

Motivator

Because the fields are well defined and have a field delimiter of \n and a key value pair delimiter of : extracting fields is, in fact, very straight forward.

However what you have so far is only referencing the line breaking.

Try this:

props.conf

[request]
KV_MODE = none
SHOULD_LINEMERGE = true
BREAK_ONLY_BEFORE = Row
REPORT-extractions = field_extractions


transforms.conf
[[field_extractions]
DELIMS = "\n" , ":"

This will break out your fields.

If you want Splunk to break out the key value pairs separated by an "=" in the Request Distinguished Name: field, then change KV_MODE = auto (this is the default)

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.