All Apps and Add-ons

Split field value into multiple field names and values & normalization

andresito123
Communicator

Hello to the community!

I have the following jboss log:

[2018-12-07 14:17:23,661] [INFO] [xxx.common.ldap.connections.TimedAuthenticator] (default task-4) ()   Authentication succeeded for dn: CN=XXX,OU=YYY,DC=external,DC=ZZZ,DC=LLL

Using the jboss app, I have the following field name and value:

signature=Authentication succeeded for dn: CN=XXX,OU=YYY,DC=external,DC=ZZZ,DC=LLL

How can I keep this value and on top of that create the following name/values:

event=Authentication succeeded
action=success
user=XXX
src_bunit=YYY

My goal is to normalize the logs and map them to CIM in order to be parsed properly by Enterprise Security App.

Any clues?

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

You can use FIELDALIAS in props.conf. Or use an eval at search time.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You can use FIELDALIAS in props.conf. Or use an eval at search time.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

New Cloud Intrusion Detection System Add-on for Splunk

In July 2022 Splunk released the Cloud IDS add-on which expanded Splunk capabilities in security and data ...

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...