How to import data from file *.log from Active Directory to SPLUNK?

[mazurmateusz]

Hello All,

After uploading Windows Active Directory data from file '.log' to SPLUNK, i recognized that all data is not parsed.

To be honest- data looks like trash 😕 (imported as a one big row_event)

Any advice how to parse data from log file to let's say format readable from SPLUNK?
Maybe you know some scripts or any other way to parse file with extension '.log' to SPLUNK.

thanks in advance,

Mateusz

[woodcock · Accepted solution]

Somebody probably redefined LINE_BREAKER in the global props.conf file (either $SPLUNK_HOME/etc/system/default/ or ${SPLUNK_HOME}/etc/system/local/). The right thing to do is to move his global-context configuration changes to an app (context) and then your stuff (and others in the future) will work as they should right out of the box. Short of that, create an app for your stuff (which you should really do anyway in $SPLUNK_HOME/etc/MyApp/default/props.conf) and put this line in it:

LINE_BREAKER = ([\r\n]+)

Read up on all this here:
http://docs.splunk.com/Documentation/Splunk/6.2.3/Data/Indexmulti-lineevents

[mazurmateusz]

Thanks for answer - I'm going to check this and give back information.