Getting Data In

How to parse Radius log files into splunk? What the configuration required for props and transforms

alenseb
Communicator

Following is the Radius log file format that i have got. Now i need only few of the fields from each instance. Also you can see that 2 instances are separated by a blank line.
So can anyone help with the configuration of prop.conf and transfroms.conf to get the desired output.

Tue Aug 7 00:00:00 2012
User-Name = "xxxxxxxx"
NAS-Port = xxxxxxxx
NAS-IP-Address = xxxxxxxxu
Framed-IP-Address = xxxxxxxx
Filter-Id = " xxxxxxxx "
Class = " xxxxxxxx "
NAS-Identifier = " xxxxxxxx "
Acct-Status-Type = xxxxxxxx
Acct-Delay-Time = 0
Acct-Session-Id = " xxxxxxxx "
Acct-Authentic = RADIUS
Event-Timestamp = 1344286800
NAS-Port-Type = Ethernet
Calling-Station-Id = " xxxxxxxx "
NAS-Port-Id = " xxxxxxxx "
Service-Type = Framed-User
Framed-Protocol = PPP
Acct-Link-Count = 0
RB-Agent-Circuit-Id = " xxxxxxxx "
DSLForum-Agent-Circuit-Id = " xxxxxxxx "
DSLForum-Access-Loop-Encapsulation = ""
Timestamp = 1344286800
OSC-Service-Identifier = "DSLUsers"
Proxy-State = OSC-Extended-Id=40682
Timestamp = 1344286800

Tue Aug 7 00:00:00 2012
User-Name = " xxxxxxxx "
NAS-Port = xxxxxxxx
NAS-IP-Address = xxxxxxxx
Framed-IP-Address = xxxxxxxx
Class = "44620232:04:"
NAS-Identifier = " xxxxxxxx "
Acct-Status-Type = Stop
Acct-Delay-Time = 0
Acct-Input-Octets = 6021
Acct-Output-Octets = 323749
Acct-Session-Id = " xxxxxxxx "
Acct-Authentic = RADIUS
Acct-Session-Time = 1348
Acct-Input-Packets = 53
Acct-Output-Packets = 3187
Acct-Terminate-Cause = User-Request
Acct-Input-Gigawords = 0
Acct-Output-Gigawords = 0
Event-Timestamp = 1344286800
NAS-Port-Type = Ethernet
Calling-Station-Id = " xxxxxxxx "
NAS-Port-Id = " xxxxxxxx "
Service-Type = Framed-User
Framed-Protocol = PPP
Acct-Link-Count = 0
Timestamp = 1344286800
OSC-Service-Identifier = "DSLUsers"
Proxy-State = OSC-Extended-Id=24386
Timestamp = 1344286800

Thanks!!

0 Karma

beatus
Communicator

alenseb,
You should avoid the use of SHOULD_LINEMERGE = true and any break_before or break_after parameters. They're not required to do linebreaking correctly in almost all cases. Here's what should work for you:

[radius]
SHOULD_LINEMERGE = false
TIME_FORMAT = %A %B %d %H:%M:%S %Y
TIME_PREFIX = ^
MAX_TIMESTAMP_LOOKAHEAD = 40
LINE_BREAKER = ([\r\n]+)\w{3}\s+\w{3}\s+\d{1,2}\s+\d{2}:\d{2}:\d{2}\s+\d{4}
TRUNCATE = 99999

sudoritz
Explorer

Thanks That WORKS 🙂

0 Karma

lguinn2
Legend

I think all you need is props.conf - and frankly, I think that the Splunk default settings would work just fine.
Splunk will automatically extract all the fields, as they are in name=value format. But here is a stanza for props.conf that should work as well. Note that this assumes that you set sourcetype=radius in the inputs.conf

And these props.conf entries belong on the indexer (or wherever the events are being parsed).

[radius]
SHOULD_LINEMERGE = true
BREAK_ONLY_BEFORE_DATE = true
TIME_FORMAT = %A %B %d %H:%M:%S %Y
0 Karma

alenseb
Communicator

Thanks for the input!!

You can also try the following code, It works as well

SHOULD_LINEMERGE = true
REPORT-vievents = vievents_extractions
BREAK_ONLY_BEFORE = ^(Sun|Mon|Tue|Wed|Thu|Fri|Sat)

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...