Getting Data In

How to change IDS logs to JSON format and index in Splunk?

hermyphang
Engager

Hi, I trying to index ids logs into splunk server however the log is not in good format.
How can i reformat the log into json so it will have table for timestamp, event type, src ip, and the rest.
I have try to edit props.conf but still the same.
Anything should I do get this work.
Thanks.

[suricata]
KV_MODE = json
NO_BINARY_CHECK = 1
TRUNCATE = 0

Here my log in splunk server

Aug 3 23:59:45 192.168.1.200 Aug 3 23:59:43 IDS suricata: {"timestamp":"2014-08-03T23:59:43.946222","event_type":"alert","src_ip":"192.168.20.1","src_port":6000,"dest_ip":"8.8.8.8","dest_port":22,"proto":"TCP","alert":{"action":"allowed","gid":1,"signature_id":2001219,"rev":18,"signature":"ET SCAN Potential SSH Scan","category":"Attempted Information Leak","severity":2}}

Tags (2)
0 Karma

MuS
SplunkTrust
SplunkTrust

Hi hermyphang,

KV_MODE in props.conf is only for search-time field extraction not index-time:

KV_MODE = [none|auto|auto_escaped|multi|json|xml]
 * Used for search-time field extractions only.

Also bear in mind, that the log format must be correct JSON and not some semi-fake JSON like log - you can check the format here

Use the TRANSFORMS field extraction type to create index-time field extractions.

NOTE: Index-time field extractions have performance implications. Creating additions to
Splunk's default set of indexed fields is ONLY recommended in specific circumstances.

Whenever possible, extract fields only at search time.

hope that helps ...

cheers, MuS

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...