Getting Data In

Grabbing IPs from unstructure logs?

jharris1111
Engager

I'm a splunk beginner, and have been able to do all kinds of interesting things with my logs that are structured as attribute=value pairs. The attribute names are discovered and I can graph the top 10 occurrences, etc.

What I'm having a harder time with is my logs that do not have attribute names built in. For example, my DHCP logs, I want to analyze IP address assignments, unusual MAC addresses, hostname to MAC or IP, etc. I've had some success with 'rex' on other logs, but not with these. Is rex the best/easiest way? Other suggestions for learning the fields I want?

Jul 31 10:53:52 dnsmasq-dhcp[24852]: DHCPACK(br0) 10.31.11.164 00:26:08:68:6c:8a

Jul 31 10:53:52 dnsmasq-dhcp[24852]: DHCPREQUEST(br0) 10.31.11.164 00:26:08:68:6c:8a

Jul 31 10:24:32 dnsmasq-dhcp[24852]: DHCPACK(br0) 10.31.11.249 00:18:dd:33:0e:f4 HDHR-2140DF1C

Jul 31 08:30:55 dnsmasq-dhcp[24852]: DHCPACK(br0) 10.31.11.107 00:23:6c:bb:f4:15 wifi-extreme

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Try this Regex in your rex command:

your_search | rex field=_raw "\w+\s\d+\s\d+:\d+:\d+\s(?<process_name>[^\[]*)\[(?<pid>\d+)\]:\s(?<action>[^\(]*)\((?<interface>[^\)]*)\)\s(?<src_ip>[^\s]*)\s(?<src_mac>[^\s]*)\s(?<src_host>[^\s]*)"

You can also do it automatically in props/transforms.

props.conf
[sourcetypeForDHCP]
REPORT-0auto_fields = dhcp-field-ext

transforms.conf
[dhcp-field-ext]
REGEX = \w+\s\d+\s\d+:\d+:\d+\s([^\[]*)\[(\d+)\]:\s([^\(]*)\(([^\)]*)\)\s([^\s]*)\s([^\s]*)\s([^\s]*)
FORMAT = process_name::$1 pid::$2 action::$3 interface::$4 src_ip::$5 src_mac::$6 src_host::$7
MV_ADD = true

jharris1111
Engager

Thanks, alacercogitatus.

This worked great and I was able to re-use this solution for some similar analysis.

0 Karma

jspears
Communicator

This worked for me after changing the beginning of the rex to "\w+\s+" , using this against dnmasq-dhcp syslog from Tomato firmware.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...