Getting Data In

How to import data from file *.log from Active Directory to SPLUNK?

mazurmateusz
Engager

Hello All,

After uploading Windows Active Directory data from file '.log' to SPLUNK, i recognized that all data is not parsed.

To be honest- data looks like trash 😕 (imported as a one big row_event)

Any advice how to parse data from log file to let's say format readable from SPLUNK?
Maybe you know some scripts or any other way to parse file with extension '.log' to SPLUNK.

thanks in advance,

Mateusz

0 Karma
1 Solution

woodcock
Esteemed Legend

Somebody probably redefined LINE_BREAKER in the global props.conf file (either $SPLUNK_HOME/etc/system/default/ or ${SPLUNK_HOME}/etc/system/local/). The right thing to do is to move his global-context configuration changes to an app (context) and then your stuff (and others in the future) will work as they should right out of the box. Short of that, create an app for your stuff (which you should really do anyway in $SPLUNK_HOME/etc/MyApp/default/props.conf) and put this line in it:

LINE_BREAKER = ([\r\n]+)

Read up on all this here:
http://docs.splunk.com/Documentation/Splunk/6.2.3/Data/Indexmulti-lineevents

View solution in original post

woodcock
Esteemed Legend

Somebody probably redefined LINE_BREAKER in the global props.conf file (either $SPLUNK_HOME/etc/system/default/ or ${SPLUNK_HOME}/etc/system/local/). The right thing to do is to move his global-context configuration changes to an app (context) and then your stuff (and others in the future) will work as they should right out of the box. Short of that, create an app for your stuff (which you should really do anyway in $SPLUNK_HOME/etc/MyApp/default/props.conf) and put this line in it:

LINE_BREAKER = ([\r\n]+)

Read up on all this here:
http://docs.splunk.com/Documentation/Splunk/6.2.3/Data/Indexmulti-lineevents

mazurmateusz
Engager

Thanks for answer - I'm going to check this and give back information.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...