Getting Data In

Remove DHCP Header

simuvid
Splunk Employee
Splunk Employee

Hi folks,

as DHCP logfiles contain huge headers, with always the same information, i will remove them, befor indexing the log events.

Any idea how to do that?

Cheers,

Christian

1 Solution

parallaxed
Path Finder

You'll need to do a couple of things.

Firstly, partition your DHCP data into two events as best you can - separating the salient data from the repeating headers. You can do this by setting the right LINE_BREAKER/MUST_BREAK_AFTER/BREAK_ONLY_BEFORE in props.conf

http://www.splunk.com/base/Documentation/4.1/Admin/Propsconf

You then need to discard the trash event by sending it to the nullQueue, as described here:

http://www.splunk.com/base/Documentation/4.1.4/Admin/Routeandfilterdata

View solution in original post

simuvid
Splunk Employee
Splunk Employee

Thanks for the help!

Here is what I did;

Changes to transforms.conf:

[AutoHeader-DhcpLog]
FIELDS="ID","Date","Time","Description","IP Address","Host Name","MAC Address"
DELIMS=","

#Delete all events that are not filtered with following statement
[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

#Filter all Events that starts with an ID, Date and Time and send them to the index queue
[setparsing]
REGEX = \d\d\,\d\d\/\d\d\/\d\d\,\d\d\:\d\d\:\d\d
DEST_KEY = queue

FORMAT = indexQueue

Changes to props.conf:
[DhcpLog]
CHECK_FOR_HEADER = TRUE
BREAK_ONLY_BEFORE = \d\d\,\d\d\/\d\d\/\d\d\,\d\d\:\d\d\:\d\d
REPORT-AutoHeader = AutoHeader-DhcpLog
TRANSFORMS-set= setnull,setparsing

Just in case somebody can use it! 🙂

Happy Splunking!

0 Karma

parallaxed
Path Finder

You'll need to do a couple of things.

Firstly, partition your DHCP data into two events as best you can - separating the salient data from the repeating headers. You can do this by setting the right LINE_BREAKER/MUST_BREAK_AFTER/BREAK_ONLY_BEFORE in props.conf

http://www.splunk.com/base/Documentation/4.1/Admin/Propsconf

You then need to discard the trash event by sending it to the nullQueue, as described here:

http://www.splunk.com/base/Documentation/4.1.4/Admin/Routeandfilterdata

Get Updates on the Splunk Community!

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...