Getting Data In

Extract Json with different log patterns?

deepthi5
Path Finder

Hi My json logs comes with two different patterns one with timestamp and host added sometimes and one with out these extra fields , when i dont have extra timestamp and host the extractions work better , but for the events with timestamp and host events are not breaking properly 

Type 1 Logs 

   Component: xxxxx
   Data:
   Description: xxxx
   Message: xxxxx

Accessed URL: xxxx
   Originator: xxxx
   Target: xxxx
   appName: xxxxxx
   subTarget: XYZ
   timeStamp: 1668522719915

Type 2 Logs :

Nov 15 15:31:58 ics021013230.ics-eu-1.asml.com {"appName": "XXXXXXX","Component":"XXXXX","timeStamp":"1668522718900","eventId":"2e0525","Description":"XXXX Gateway: YYYYY ","Originator":"xxxxxx","Target":xxxxx","subTarget":"xxxxx"

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

What are the props.conf settings for those two sourcetypes?  They're very different so they should be separate sourcetypes.  Also, the "Type 1" logs are not JSON.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...