Getting Data In

How to configure SEDCMD in props.conf?

jpena323
Explorer

Hi guys,

I am having a really hard time figuring out how to get the sedcmd to work in props.conf. I'd appreciate any help you can lend. Here is an example of my config:

PROPS.CONF

[source::.../syslog_logs/*srx*/user.info.log]
SEDCMD-removeunwanted1 = s/\s(src-nat-rule-name=\"[^\"]+\")//
SEDCMD-removeunwanted2 = s/\s(source-zone-name=\"[^\"]+\")//
SEDCMD-removeunwanted3 = s/\s(destination-zone-name=\"[^\"]+\")//
SEDCMD-alter1 = s/destination/dst/g
SEDCMD-alter2 = s/source/src/g
SEDCMD-alter3 = s/address/ip/g
SEDCMD-alter4 = 's/protocol-id="17"/UDP/'
SEDCMD-alter5 = 's/protocol-id="6"/TCP/'
SEDCMD-alter6 = 's/protocol-id="1"/ICMP/

The point of this is to simplify our logs from Juniper SRXs. When I do a "--debug props list | grep SEDCMD", I see the commands listed. Not sure what I'm doing incorrectly, but have a couple of questions in addition to any advice you guys have.

1.) Does this props.conf have to be configured on the forwarder or the indexer? I'd prefer to do this on the forwarder if possible.
2.) Does restarting the splunk forwarder engage the changes? Or is there something else I need to do?
3.) Is there any way to monitor logs as they come into splunk? (similar to tail -f)
4.) Do you see anything wrong with my syntax?

Thanks in advance guys! I really appreciate the help!

Tags (2)
1 Solution

sgundeti
Path Finder

Go through the props.conf example on below link

http://docs.splunk.com/Documentation/Splunk/6.2.1/admin/Propsconf

Coming to your questions
1. SED script works at index time, ie, it executed on _raw field. so answer is Indexer
2. Indexer restart is required
3. Use some sample log file and you can use preview option to verify all your rules.
4. refer to document, If you are replacing strings then it should be SED-alter=y/string1/string2/

View solution in original post

sgundeti
Path Finder

Go through the props.conf example on below link

http://docs.splunk.com/Documentation/Splunk/6.2.1/admin/Propsconf

Coming to your questions
1. SED script works at index time, ie, it executed on _raw field. so answer is Indexer
2. Indexer restart is required
3. Use some sample log file and you can use preview option to verify all your rules.
4. refer to document, If you are replacing strings then it should be SED-alter=y/string1/string2/

jpena323
Explorer

thanks - im going to try to add this to the indexer and see if it works

0 Karma

Marcia_Piccione
Engager

Can this be used in an intermediate forwarder?

0 Karma

landen99
Motivator

Does it not depend on where the data parsing phase is executed?

acharlieh
Influencer

It needs to be done on a Splunk instance doing parsing. That'd be an Indexer or Heavy Forwarder, but not a Universal Forwarder.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...