Getting Data In

Field extraction from simple one-sentense log

Path Finder

Can anybody help me to create props.conf and transforms.conf files to correctly parse such logs?



"2020-10-08 09:35:56","Department1","Department2","","","Allowed","1 (A)","NOERROR","","Search Engines","Networks","Networks",""
"2020-10-08 09:35:56","Department1","Department2","","","Allowed","1 (A)","NOERROR","","Search Engines,Malware","Networks","Networks",""
"2020-10-08 09:35:56","Department1","Department2","","","Allowed","1 (A)","NOERROR","","Search Engines,Malware, Network","Networks","Networks",""
"2020-10-08 09:35:56","Department1","Department2","","","Allowed","1 (A)","NOERROR","","Malware","Networks","Networks",""



 As you see, here the log with the category field "Search Engines,Malware" should belong to both categories: Search Engines and Malware. So, the category field can consist of 1, 2, 3 or more values.

Labels (3)
0 Karma

Super Champion

@user2020dy try like below-
props.conf -

LINE_BREAKER = ([\r\n]+)
category = Custom
TIME_FORMAT = %Y-%m-%d %H:%M:%S
REPORT-main = parse 

transforms.conf - 

DELIMS = ","
FIELDS = Time,field1,field2,field3,field4,field5,field6,field7,field8,field9,field10,field11,field12,field13


Let me know if it helps! and upvote will be appreciated

0 Karma

Path Finder

thank you, it helps to parse most logs, but the field category can contain 2 or 3 values 


Can you prompt how to delimeter these values?

0 Karma

Super Champion

you can use rex command to separate values within category.

0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...