Getting Data In

Field extraction from simple one-sentense log

user2020dy
Path Finder

Can anybody help me to create props.conf and transforms.conf files to correctly parse such logs?

 

 

"2020-10-08 09:35:56","Department1","Department2","113.8.10.134","113.8.10.132","Allowed","1 (A)","NOERROR","ant.com.","Search Engines","Networks","Networks",""
"2020-10-08 09:35:56","Department1","Department2","113.8.10.134","113.8.10.132","Allowed","1 (A)","NOERROR","ant.com.","Search Engines,Malware","Networks","Networks",""
"2020-10-08 09:35:56","Department1","Department2","113.8.10.134","113.8.10.132","Allowed","1 (A)","NOERROR","ant.com.","Search Engines,Malware, Network","Networks","Networks",""
"2020-10-08 09:35:56","Department1","Department2","113.8.10.134","113.8.10.132","Allowed","1 (A)","NOERROR","ant.com.","Malware","Networks","Networks",""

 

 

 As you see, here the log with the category field "Search Engines,Malware" should belong to both categories: Search Engines and Malware. So, the category field can consist of 1, 2, 3 or more values.

Labels (3)
0 Karma

493669
Super Champion

@user2020dy try like below-
props.conf -

[sourcetype_name]
LINE_BREAKER = ([\r\n]+)
SHOULD_LINEMERGE = false
category = Custom
TIME_PREFIX = ^\"
MAX_TIMESTAMP_LOOKAHEAD = 30
TIME_FORMAT = %Y-%m-%d %H:%M:%S
REPORT-main = parse 

transforms.conf - 

[parse]
DELIMS = ","
FIELDS = Time,field1,field2,field3,field4,field5,field6,field7,field8,field9,field10,field11,field12,field13

 

Let me know if it helps! and upvote will be appreciated

0 Karma

user2020dy
Path Finder

thank you, it helps to parse most logs, but the field category can contain 2 or 3 values 

user2020dy_0-1602159492323.png

Can you prompt how to delimeter these values?

0 Karma

493669
Super Champion

you can use rex command to separate values within category.


0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...