The events are not parsing

[jibin1988]

Hi,
I am using Expanded Snare syslog app in HF. But the problem here is the data is not getting parsed as per the props.conf in the app.

Do we have to install this app in indexers as well ? OR HF will do the parsing before sending the logs to indexers?

Please help!!

props.conf :

[windows_snare_syslog]
MAX_TIMESTAMP_LOOKAHEAD = 32
TRANSFORMS = syslog-host
REPORT-syslog = syslog-extractions
REPORT-colon_1 = snare_colon_1
REPORT-colon_2 = snare_colon_2
#REPORT-colon_3 = snare_colon_3

EXTRACT-Event_ID = (?i)^(?:[^\t]*\t){5}(?P[^\t]+)
EXTRACT-Event_Log = (?i)^(?:[^\t]*\t){2}(?P[^\t]+)
EXTRACT-Event_Source = (?i)^(?:[^\t]*\t){6}(?P[^\t]+)

SHOULD_LINEMERGE = False
TIME_FORMAT = %b %d %H:%M:%S

[woodcock]

For props.conf files, best-practice is to deploy EVERYWHERE. In your case, you must deploy:

These go to the HF:

 [windows_snare_syslog]
 MAX_TIMESTAMP_LOOKAHEAD = 32
 TRANSFORMS = syslog-host
 SHOULD_LINEMERGE = False
 TIME_FORMAT = %b %d %H:%M:%S

These go to Search Head:

 [windows_snare_syslog]
 REPORT-syslog = syslog-extractions
 REPORT-colon_1 = snare_colon_1
 REPORT-colon_2 = snare_colon_2
 #REPORT-colon_3 = snare_colon_3
 EXTRACT-Event_ID = (?i)^(?:[^\t]*\t){5}(?P[^\t]+)
 EXTRACT-Event_Log = (?i)^(?:[^\t]*\t){2}(?P[^\t]+)
 EXTRACT-Event_Source = (?i)^(?:[^\t]*\t){6}(?P[^\t]+)

But just deploy it everywhere.

[oscar84x]

The HF alone should do the trick but you could put the props and transforms on both the indexer and the HF just in case.
More importantly though, this seems to be a very old app. Have you checked that the extracts/regex, timestamps, etc in the app match the patterns on your events?

[sanjeev543]

Hi @jibin1988 could you please be more specific, what exactly is not getting parsed?
Is it line breaking? time stamp or field extractions?

Also please provide some sample events for us to check and identify the issue