Getting Data In

Remove DHCP Header

simuvid
Splunk Employee
Splunk Employee

Hi folks,

as DHCP logfiles contain huge headers, with always the same information, i will remove them, befor indexing the log events.

Any idea how to do that?

Cheers,

Christian

1 Solution

parallaxed
Path Finder

You'll need to do a couple of things.

Firstly, partition your DHCP data into two events as best you can - separating the salient data from the repeating headers. You can do this by setting the right LINE_BREAKER/MUST_BREAK_AFTER/BREAK_ONLY_BEFORE in props.conf

http://www.splunk.com/base/Documentation/4.1/Admin/Propsconf

You then need to discard the trash event by sending it to the nullQueue, as described here:

http://www.splunk.com/base/Documentation/4.1.4/Admin/Routeandfilterdata

View solution in original post

simuvid
Splunk Employee
Splunk Employee

Thanks for the help!

Here is what I did;

Changes to transforms.conf:

[AutoHeader-DhcpLog]
FIELDS="ID","Date","Time","Description","IP Address","Host Name","MAC Address"
DELIMS=","

#Delete all events that are not filtered with following statement
[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

#Filter all Events that starts with an ID, Date and Time and send them to the index queue
[setparsing]
REGEX = \d\d\,\d\d\/\d\d\/\d\d\,\d\d\:\d\d\:\d\d
DEST_KEY = queue

FORMAT = indexQueue

Changes to props.conf:
[DhcpLog]
CHECK_FOR_HEADER = TRUE
BREAK_ONLY_BEFORE = \d\d\,\d\d\/\d\d\/\d\d\,\d\d\:\d\d\:\d\d
REPORT-AutoHeader = AutoHeader-DhcpLog
TRANSFORMS-set= setnull,setparsing

Just in case somebody can use it! 🙂

Happy Splunking!

0 Karma

parallaxed
Path Finder

You'll need to do a couple of things.

Firstly, partition your DHCP data into two events as best you can - separating the salient data from the repeating headers. You can do this by setting the right LINE_BREAKER/MUST_BREAK_AFTER/BREAK_ONLY_BEFORE in props.conf

http://www.splunk.com/base/Documentation/4.1/Admin/Propsconf

You then need to discard the trash event by sending it to the nullQueue, as described here:

http://www.splunk.com/base/Documentation/4.1.4/Admin/Routeandfilterdata

Get Updates on the Splunk Community!

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...

New Splunk APM Enhancements Help Troubleshoot Your MySQL and NoSQL Databases Faster

Splunk Observability has two new enhancements to make it quicker and easier to troubleshoot slow or frequently ...