Splunk Search

best practice for custom syslog field extraction

Skins
Path Finder

I have a syslog file and none of the default sourcetypes give me what i want - so i have:

any advice on best approach for props.conf

Apr 15 16:54:01 HOSTNAMEX Group CfgSrvc: hd[0]: cfgcore: WritePhase2(Security,system,security.authentication.accounts[0].adminaccount.failedlogincount) value update "9234" => "9235"
Apr 15 16:54:01 HOSTNAMEX Group CfgSrvc: hd[0]: cfgcore: callback DynamicValidate(Security,"807847",system,{security[0].authentication[0].accounts[0].adminaccount[0].failedlogincount[0]/local,"9235"},"PlatCfgS/5/01-0"[17])
Apr 15 16:54:01 HOSTNAMEX Group Security: hd[0]: SecurityService: login login failed, increment # of failed logins
Apr 15 16:54:01 HOSTNAMEX Group Security: hd[0]: SecurityService: login login failed, setLoginResult 6
Apr 15 16:54:01 HOSTNAMEX Group Security: hd[0]: SecurityService:  If loginSuccess is false ( 
Apr 15 16:54:01 HOSTNAMEX Group Security: hd[0]: SecurityService: LocalAuthenticator::login, role 3 loginSuccess 0
Apr 15 16:54:01 HOSTNAMEX Group Security: hd[0]: SecurityService: SecurityServiceLoginRequest(): username: admin
Apr 15 16:54:01 HOSTNAMEX Group logcat: hd[0]: UAppSvcs(2132): (legacyapi) API:OUT:Password: 
Apr 15 16:54:01 HOSTNAMEX Group logcat: hd[0]: UAppSvcs(2132): (legacyapi) API:OUT: -- password failed, retry --

gratzi

Tags (1)
0 Karma

chris_barrett
Communicator

A quick Google would suggest that the logs are coming from a Polycom system/device of some sort.

The following is completely untested but itshould be enough to make start. You didn't say what the data is currently being sourcetype as so I've catered for it coming in as "syslog" and it then being overridden to "polycom". Ideally though it would be easier if the events were sourcetyped as polycom by the monitor stanza.

If you're open to providing me with a bigger sample of logs then I'd be happy to assist with a view to developing a TA that could be released to SplunkBase for the benefit of anyone else with these systems/devices.

--- props.conf ---

[syslog]
TRANSFORMS-override_sourcetype_for_polycom = override_sourcetype_for_polycom

[polycom]
SHOULD_LINEMERGE = false
TIME_PREFIX = ^
EXTRACT-polycom_basics = \s(?<hostname>\S+?)\sGroup\s(?<unknown_01>[^:]+?):\s(?<unknown_02>[^:]+?):\s(?<unknown_03>[^:]+?):\s(?<message>.+?)$

--- transforms.conf ---

[override_sourcetype_for_polycom]
SOURCE_KEY = _raw
REGEX = \sGroup\s(CfgSrvc|Security|logcat|):\s
DEST_KEY = MetaData:Sourcetype
FORMAT = sourcetype::polycom
0 Karma

kmorris_splunk
Splunk Employee
Splunk Employee

If there isn't a Splunk Add-on for this source, you will need to teach Splunk what the fields are. This can be done via the GUI, which will update props.conf for you for that sourcetype. https://docs.splunk.com/Documentation/Splunk/7.2.5/Knowledge/FXSelectSamplestep

You could also do it by manually editing the props.conf if you are more adventurous.
https://docs.splunk.com/Documentation/Splunk/7.2.5/Knowledge/Createandmaintainsearch-timefieldextrac...

0 Karma

skalliger
SplunkTrust
SplunkTrust

Best way to go would be to get familiar with the Add-on builder.

Skalli

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...