Creating Splunk App to parse syslogs

[hm222jy]

I would like to find a detaild tutorial on how to create a splunk app to parse syslogs, with pre-defined field names, not the automatic key/value that splunk is able to detect.

I have syslogs with different log types, I wonder if there is some documentation/tutorial on this. Can anyone point in the right direction? I am new to splunk. Thanks.

[hm222jy]

Grazie Giuseppe.  The documentation sometimes is hard to digest for newbies but will try to go through it. 

[gcusello]

Hi @hm222jy,

try to have the documentation of the Admin Training, or (better) follow this training.

It's also useful to follow the Sales Engineers I and II Training Courses, where log ingestion is described .

Ciao and happy splunking.

Giuseppe

[gcusello · Accepted solution]

Hi @hm222jy,

to do this you have the following items:

• identify each type pf syslog fpr your flows,
• group all the one with the same structure,
• create a sourcetype for each type defining the specifications of each one:
  • event breaks,
  • timestamp,
  • field extractions,
  • eventtypes,
  • tags,
  • aliases,
  • fields calculations.
• eventually check the CIM compliance of your sourcetypes.

all these configurations will be in props.conf and transforms.conf files that you can put in one or more Technical Add-Ons (TAs).

You can find documentazione about this in:

https://docs.splunk.com/Documentation/Splunk/8.1.2/Data/WhatSplunkcanmonitor

https://docs.splunk.com/Documentation/Splunk/8.1.2/Admin/Configurationparametersandthedatapipeline

https://docs.splunk.com/Documentation/CIM/4.18.0/User/Overview

Ciao.

Giuseppe