How can I parse iso 8583 messages in Splunk?

[indeed_2000]

Hi

How can I parse iso 8583 messages in Splunk?

Here is the sample iso 8583 message that exist in my log:

10:10:00 Message [0200323A40010841801038000000000000000004200508050113921208050420042251320720000010000001156040800411 01251146333156336000299]

I want to parse message and extract fields in it.

Like this website that parse sample message

https://licklider.cl/services/financial/iso8583parser/

more info:

https://en.wikipedia.org/wiki/ISO_8583

http://www.lytsing.org/downloads/iso8583.pdf

any idea?

Thanks

[Netpbcl]

You need to parse the message before inserting to splunk. I have solved it like this for splunk, elk and opensearch, if your need help : contact me netpbcl@gmail.com

[richgalloway]

I recommend writing an external command to parse those events.

[Netpbcl]

I recommend www.monitoriso8583.com with them you can solve the capture and transformation of messages to splunk and others as well.