Getting Data In

How to change IDS logs to JSON format and index in Splunk?

hermyphang
Engager

Hi, I trying to index ids logs into splunk server however the log is not in good format.
How can i reformat the log into json so it will have table for timestamp, event type, src ip, and the rest.
I have try to edit props.conf but still the same.
Anything should I do get this work.
Thanks.

[suricata]
KV_MODE = json
NO_BINARY_CHECK = 1
TRUNCATE = 0

Here my log in splunk server

Aug 3 23:59:45 192.168.1.200 Aug 3 23:59:43 IDS suricata: {"timestamp":"2014-08-03T23:59:43.946222","event_type":"alert","src_ip":"192.168.20.1","src_port":6000,"dest_ip":"8.8.8.8","dest_port":22,"proto":"TCP","alert":{"action":"allowed","gid":1,"signature_id":2001219,"rev":18,"signature":"ET SCAN Potential SSH Scan","category":"Attempted Information Leak","severity":2}}

Tags (2)
0 Karma

MuS
SplunkTrust
SplunkTrust

Hi hermyphang,

KV_MODE in props.conf is only for search-time field extraction not index-time:

KV_MODE = [none|auto|auto_escaped|multi|json|xml]
 * Used for search-time field extractions only.

Also bear in mind, that the log format must be correct JSON and not some semi-fake JSON like log - you can check the format here

Use the TRANSFORMS field extraction type to create index-time field extractions.

NOTE: Index-time field extractions have performance implications. Creating additions to
Splunk's default set of indexed fields is ONLY recommended in specific circumstances.

Whenever possible, extract fields only at search time.

hope that helps ...

cheers, MuS

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...