Getting Data In

Insert text into certain logs going to a 3rd party?

eblackburn
Path Finder

I'm looking to insert some text at our heavy forwarder into certain sourcetypes that a 3rd party running syslog-ng will see and be able to better identify what the logs are. For example, "IISLog", or "DHCPLog". Does anyone have any experience doing this?

Here's a sample log:

2021-01-26 20:12:28 192.168.58.11 POST /PerspectiveServices/SecureService.asmx - 443 - 192.168.49.24 Mozilla/4.0+(compatible;+MSIE+6.0;+SV1;+MS+Web+Services+Client+Protocol+4.0.30319.42000) - 200 0 0 26
 
This is an IIS log. I'd like to add the text somewhere (anywhere) into these logs. If it works, I'll do the same with some other sourcetypes. So the end result might be:

2021-01-26 20:12:28 192.168.58.11 IISLog POST /PerspectiveServices/SecureService.asmx - 443 - 192.168.49.24 Mozilla/4.0+(compatible;+MSIE+6.0;+SV1;+MS+Web+Services+Client+Protocol+4.0.30319.42000) - 200 0 0 26
 
We are sending them the logs from a heavy forwarder using syslog output. I was looking into potentially using SEDCMD within a props.conf file, but I'm not too experienced with doing this, and just getting started with RegEx.
 
 
Labels (5)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @eblackburn,

You use below sample. It is adding some text to end of the log since it is safer and easier.

props.conf
[iis_log]
TRANSFORMS-logtype = append_logtype

transforms.conf
[append_logtype]
REGEX = (?m)^(.*)$
FORMAT = $1 IISLog
DEST_KEY = _raw
If this reply helps you an upvote is appreciated.

View solution in original post

scelikok
SplunkTrust
SplunkTrust

Hi @eblackburn,

You use below sample. It is adding some text to end of the log since it is safer and easier.

props.conf
[iis_log]
TRANSFORMS-logtype = append_logtype

transforms.conf
[append_logtype]
REGEX = (?m)^(.*)$
FORMAT = $1 IISLog
DEST_KEY = _raw
If this reply helps you an upvote is appreciated.
Get Updates on the Splunk Community!

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...