Getting Data In

Field extraction from simple one-sentense log

user2020dy
Path Finder

Can anybody help me to create props.conf and transforms.conf files to correctly parse such logs?

 

 

"2020-10-08 09:35:56","Department1","Department2","113.8.10.134","113.8.10.132","Allowed","1 (A)","NOERROR","ant.com.","Search Engines","Networks","Networks",""
"2020-10-08 09:35:56","Department1","Department2","113.8.10.134","113.8.10.132","Allowed","1 (A)","NOERROR","ant.com.","Search Engines,Malware","Networks","Networks",""
"2020-10-08 09:35:56","Department1","Department2","113.8.10.134","113.8.10.132","Allowed","1 (A)","NOERROR","ant.com.","Search Engines,Malware, Network","Networks","Networks",""
"2020-10-08 09:35:56","Department1","Department2","113.8.10.134","113.8.10.132","Allowed","1 (A)","NOERROR","ant.com.","Malware","Networks","Networks",""

 

 

 As you see, here the log with the category field "Search Engines,Malware" should belong to both categories: Search Engines and Malware. So, the category field can consist of 1, 2, 3 or more values.

Labels (3)
0 Karma

493669
Super Champion

@user2020dy try like below-
props.conf -

[sourcetype_name]
LINE_BREAKER = ([\r\n]+)
SHOULD_LINEMERGE = false
category = Custom
TIME_PREFIX = ^\"
MAX_TIMESTAMP_LOOKAHEAD = 30
TIME_FORMAT = %Y-%m-%d %H:%M:%S
REPORT-main = parse 

transforms.conf - 

[parse]
DELIMS = ","
FIELDS = Time,field1,field2,field3,field4,field5,field6,field7,field8,field9,field10,field11,field12,field13

 

Let me know if it helps! and upvote will be appreciated

0 Karma

user2020dy
Path Finder

thank you, it helps to parse most logs, but the field category can contain 2 or 3 values 

user2020dy_0-1602159492323.png

Can you prompt how to delimeter these values?

0 Karma

493669
Super Champion

you can use rex command to separate values within category.


0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...