Getting Data In

How to substitute a group of multiple lines with a single value



I'm using eventgen to create sample data.

Whenever someone runs a command, the Linux audits will record the event over multiple lines.

For example, if someone uses sudo to run 'cat /etc/shadow'. The audit log will record the user's attempt to access sudo, then another line that will show the authentication status (success or failure), then the actual command, '/etc/shadow', etc...

Is there a way to set the token replacement to change the username, hostname, time, command for that event and do it, say 30 times. Each event which has multiple lines with have the same username, hostname, time and command. Then the next event will have a different username, hostname, time and command?



Labels (1)
Tags (2)
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!