Getting Data In

How can I parse bacticks/grave accents (`) in syslog?

cleartext
New Member

Hi,

I have a log that separate using Grave Accent

3`0`1`1`1dk3ad`1020`20140301`10:53:37`1`17`140219185904`172.3.196.184`58493`204.126.63.2`53`eth5`eth6`````````````\xB3\xBB\xBA\xCE`\xBFܺ\xCE`44`N/A`4````
3`0`1`1`1dk3ad`1020`20140301`10:45:53`1`17`140124184856`192.11.2.125`65226`204.124.101.2`53`eth0`eth1`SNAT`172.3.196.240`65226``````````\xB3\xBB\xBA\xCE`\xBFܺ\xCE`43`IB_NAT:12`4````

How can I parse this log?

add ` in segmenters.conf ?

or regex?

Tags (2)
0 Karma

woodcock
Esteemed Legend

There is no reason to change segmenters.conf because it should already be segmenting along your data elements because the graves will create segment breaks (being that they are punctuation marks). You should be able to use any of the RegEx-based options for field extractions with no problems. For example, you can use rex like this:

... | rex field=raw "(?<field1>[^`]+)`(?<field2>[^`]+)`(?<field3>[^`]+)`(?<field5>[^`]+)`"
0 Karma

tonykung
New Member

what i would do is to format the log before forwarding to splunk. even you can successfully submit it , you will face trouble when querying.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...