Getting Data In

REGEX help with ingesting XML file. Timestamp not working correctly

joesrepsol
Path Finder

Looking to extract the "2017-06-23 15:48:56.218" from the 2nd line in the log and use it for the timestamp when ingesting this xml log into Splunk. Today Splunk is picking up the wrong timestamp for the timestamp recognition, which causes problems.

Thinking that I need to define some REGEX in a props.conf/transforms.conf file but missing the REGEX experience to pull this out.

Help?

<auditEvent encrypted="n" signed="n">
    <localTime>2017-06-23 15:48:56.218 -0700</localTime>
    <time>2017-06-23 22:48:56.218</time>
    <utc>2017-06-23 22:48:56.218</utc>
    <sessionId>25</sessionId>
    <msg>
        <msgID>AUD0117E</msgID>
        <msgText>SessionId: 25 - Login attempt to CM by intruder through local store Failed with an operator role of UNKNOWN ROLE</msgText>
        <condCode>8</condCode>
    </msg>
</auditEvent>

using Splunk Enterprise 6.5.0 (Linux)

Tags (1)
0 Karma

joesrepsol
Path Finder

Also noticed that Splunk is not automatically figuring out which breaks to use for the entire event... WHOA. In this case, it's XML and I need to also figure out how to tell splunk that each event starts with:

<auditEvent encrypted="n" signed="n">

and ends with:

</auditEvent>
0 Karma

joesrepsol
Path Finder

Clarification...

Looking to pull the date/time stamp between "" and "-0700"

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...