Getting Data In

How to map data from raw logs to key/value pairs to be searched in Splunk?

MayankSplunk
Path Finder

I have splunk forwarder setup to forward cloudfront logs on S3, say following is the example of raw logs:

2015-01-15  20:59:36    LHR50   334 90.201.16.203   GET zfu.cloudfront.net

Can someone give me an example how to map them to key=value pairs? so I can query them in splunk

0 Karma

dflodstrom
Builder

I suggest using the field extractor. If you are running 6.2.x this feature has improved greatly. Have a look here: http://docs.splunk.com/Documentation/Splunk/6.2.1/Knowledge/ExtractfieldsinteractivelywithIFX

You can extract fields using props/transoforms but for simple extractions the Interactive Field Extractor works great.

0 Karma

MayankSplunk
Path Finder

Thanks for the reply, I was trying to do it as how explained below

http://docs.splunk.com/Documentation/AddOns/released/CiscoWSA/Configurew3clogfieldextractions

Cloudfront format is as following

Fields: date time x-edge-location sc-bytes c-ip cs-method cs(Host) cs-uri-stem sc-status cs(Referer) cs(User-Agent) cs-uri-query cs(Cookie) x-edge-result-type x-edge-request-id x-host-header cs-protocol cs-bytes time-taken

I tried steps mentioned in link above but still doesn't work, do I need to change prop.conf for this?

0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee
0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...