Getting Data In

Field extraction from simple one-sentense log

user2020dy
Path Finder

Can anybody help me to create props.conf and transforms.conf files to correctly parse such logs?

 

 

"2020-10-08 09:35:56","Department1","Department2","113.8.10.134","113.8.10.132","Allowed","1 (A)","NOERROR","ant.com.","Search Engines","Networks","Networks",""
"2020-10-08 09:35:56","Department1","Department2","113.8.10.134","113.8.10.132","Allowed","1 (A)","NOERROR","ant.com.","Search Engines,Malware","Networks","Networks",""
"2020-10-08 09:35:56","Department1","Department2","113.8.10.134","113.8.10.132","Allowed","1 (A)","NOERROR","ant.com.","Search Engines,Malware, Network","Networks","Networks",""
"2020-10-08 09:35:56","Department1","Department2","113.8.10.134","113.8.10.132","Allowed","1 (A)","NOERROR","ant.com.","Malware","Networks","Networks",""

 

 

 As you see, here the log with the category field "Search Engines,Malware" should belong to both categories: Search Engines and Malware. So, the category field can consist of 1, 2, 3 or more values.

Labels (3)
0 Karma

493669
Super Champion

@user2020dy try like below-
props.conf -

[sourcetype_name]
LINE_BREAKER = ([\r\n]+)
SHOULD_LINEMERGE = false
category = Custom
TIME_PREFIX = ^\"
MAX_TIMESTAMP_LOOKAHEAD = 30
TIME_FORMAT = %Y-%m-%d %H:%M:%S
REPORT-main = parse 

transforms.conf - 

[parse]
DELIMS = ","
FIELDS = Time,field1,field2,field3,field4,field5,field6,field7,field8,field9,field10,field11,field12,field13

 

Let me know if it helps! and upvote will be appreciated

0 Karma

user2020dy
Path Finder

thank you, it helps to parse most logs, but the field category can contain 2 or 3 values 

user2020dy_0-1602159492323.png

Can you prompt how to delimeter these values?

0 Karma

493669
Super Champion

you can use rex command to separate values within category.


0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...