Getting Data In

Remove DHCP Header

simuvid
Splunk Employee
Splunk Employee

Hi folks,

as DHCP logfiles contain huge headers, with always the same information, i will remove them, befor indexing the log events.

Any idea how to do that?

Cheers,

Christian

1 Solution

parallaxed
Path Finder

You'll need to do a couple of things.

Firstly, partition your DHCP data into two events as best you can - separating the salient data from the repeating headers. You can do this by setting the right LINE_BREAKER/MUST_BREAK_AFTER/BREAK_ONLY_BEFORE in props.conf

http://www.splunk.com/base/Documentation/4.1/Admin/Propsconf

You then need to discard the trash event by sending it to the nullQueue, as described here:

http://www.splunk.com/base/Documentation/4.1.4/Admin/Routeandfilterdata

View solution in original post

simuvid
Splunk Employee
Splunk Employee

Thanks for the help!

Here is what I did;

Changes to transforms.conf:

[AutoHeader-DhcpLog]
FIELDS="ID","Date","Time","Description","IP Address","Host Name","MAC Address"
DELIMS=","

#Delete all events that are not filtered with following statement
[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

#Filter all Events that starts with an ID, Date and Time and send them to the index queue
[setparsing]
REGEX = \d\d\,\d\d\/\d\d\/\d\d\,\d\d\:\d\d\:\d\d
DEST_KEY = queue

FORMAT = indexQueue

Changes to props.conf:
[DhcpLog]
CHECK_FOR_HEADER = TRUE
BREAK_ONLY_BEFORE = \d\d\,\d\d\/\d\d\/\d\d\,\d\d\:\d\d\:\d\d
REPORT-AutoHeader = AutoHeader-DhcpLog
TRANSFORMS-set= setnull,setparsing

Just in case somebody can use it! 🙂

Happy Splunking!

0 Karma

parallaxed
Path Finder

You'll need to do a couple of things.

Firstly, partition your DHCP data into two events as best you can - separating the salient data from the repeating headers. You can do this by setting the right LINE_BREAKER/MUST_BREAK_AFTER/BREAK_ONLY_BEFORE in props.conf

http://www.splunk.com/base/Documentation/4.1/Admin/Propsconf

You then need to discard the trash event by sending it to the nullQueue, as described here:

http://www.splunk.com/base/Documentation/4.1.4/Admin/Routeandfilterdata

Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...