Getting Data In

How do I use delimiter attribute in transforms.conf to extract values for each individual field whose values are enclosed in double quotes ("")?

mohammed7860
Explorer

Hi:

I have following sample events:

start_time="XXX" end_time="XXX" dest_dns="" dest_mac="" dest_ip="56.00.00.185" cpe="" dest_port_proto="6" dest_port="399" severity="2" signature_id="10001" signature_family="12" signature="The remote host supports the use of SSL ciphers that offer medium strength encryption, which we currently regard as those with key lengths at least 56 bits and less than 112 bits.\n\nNote: This is considerably easier to exploit if the attacker is on the same physical network." exploitAvailable="false" exploitEase="" synopsis="The remote service supports the use of medium strength SSL ciphers." solution="Reconfigure the affected application if possible to avoid use of medium strength ciphers." cve="" netbiosName="XXX" hasBeenMitigated="0" firstSeen="1481797392" lastSeen="1481797392" name="SSL Medium Strength Cipher Suites Supported" cvssVector="XXX" baseScore="4.3" temporalScore=""

How do I use delimiter attribute in transforms.conf to extract values for each individual field whose values are enclosed in ""?

Any help is greatly appreciated.

Mohammed

0 Karma

bambarit
Explorer

try this

 

Spoiler
((?:[^\s\|]|(?<=\\)\|)+)=\"((?:\\\=|[^=])*)"
0 Karma

securityForMe
Engager

Hi
You can configure your file $SPLUNK_HOME/etc/apps//local/props.conf like this:

[REPORT-Something]
DELIMS = " " (with a space inside)
FIELDS = "filedname1","filedname2","filedname3"

Make sure you restart splunk after change the file, then you can get the keys by split with "=".

0 Karma

somesoni2
Revered Legend

These are in standard Key value pair format and Splunk should automatically extract these fields. Have you tried ingesting it to Splunk and checked the default field extractions?

0 Karma

mohammed7860
Explorer

The default field extractions don't work. I still see the values within double quotes

0 Karma

sundareshr
Legend

Please share the props.conf stanza your are using

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...