Getting Data In

How to change IDS logs to JSON format and index in Splunk?

hermyphang
Engager

Hi, I trying to index ids logs into splunk server however the log is not in good format.
How can i reformat the log into json so it will have table for timestamp, event type, src ip, and the rest.
I have try to edit props.conf but still the same.
Anything should I do get this work.
Thanks.

[suricata]
KV_MODE = json
NO_BINARY_CHECK = 1
TRUNCATE = 0

Here my log in splunk server

Aug 3 23:59:45 192.168.1.200 Aug 3 23:59:43 IDS suricata: {"timestamp":"2014-08-03T23:59:43.946222","event_type":"alert","src_ip":"192.168.20.1","src_port":6000,"dest_ip":"8.8.8.8","dest_port":22,"proto":"TCP","alert":{"action":"allowed","gid":1,"signature_id":2001219,"rev":18,"signature":"ET SCAN Potential SSH Scan","category":"Attempted Information Leak","severity":2}}

Tags (2)
0 Karma

MuS
Legend

Hi hermyphang,

KV_MODE in props.conf is only for search-time field extraction not index-time:

KV_MODE = [none|auto|auto_escaped|multi|json|xml]
 * Used for search-time field extractions only.

Also bear in mind, that the log format must be correct JSON and not some semi-fake JSON like log - you can check the format here

Use the TRANSFORMS field extraction type to create index-time field extractions.

NOTE: Index-time field extractions have performance implications. Creating additions to
Splunk's default set of indexed fields is ONLY recommended in specific circumstances.

Whenever possible, extract fields only at search time.

hope that helps ...

cheers, MuS

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...