Getting Data In

Extract Json with different log patterns?

deepthi5
Path Finder

Hi My json logs comes with two different patterns one with timestamp and host added sometimes and one with out these extra fields , when i dont have extra timestamp and host the extractions work better , but for the events with timestamp and host events are not breaking properly 

Type 1 Logs 

   Component: xxxxx
   Data:
   Description: xxxx
   Message: xxxxx

Accessed URL: xxxx
   Originator: xxxx
   Target: xxxx
   appName: xxxxxx
   subTarget: XYZ
   timeStamp: 1668522719915

Type 2 Logs :

Nov 15 15:31:58 ics021013230.ics-eu-1.asml.com {"appName": "XXXXXXX","Component":"XXXXX","timeStamp":"1668522718900","eventId":"2e0525","Description":"XXXX Gateway: YYYYY ","Originator":"xxxxxx","Target":xxxxx","subTarget":"xxxxx"

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

What are the props.conf settings for those two sourcetypes?  They're very different so they should be separate sourcetypes.  Also, the "Type 1" logs are not JSON.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...