Tab separated events in log - how do I parse it into fields?

[brent_weaver]

I dont know why I cannot get this to work BUT, I have a log that is TSV and I want to carve out the fields. Beyond TSV the first field needs to be parsed as colon separated and my timestamp is the second part of that first field. How do I accomplish this? These are actually bro logs that do not parse correctly with he Spunk App for bro IDS. This app is for v2.4< and we are on 2.5. Any help is much appreciated!

[jkat54]

Here's one way, put this props on your forwarders & indexers.

[sourcetypeName]
INDEXED_EXTRACTIONS=TSV
FIELD_NAMES = _time, fielda, fieldb, fieldc

[brent_weaver]

Here is my props.conf:

splunk[/opt/splunk/etc/apps/bro/local] # cat props.conf
[bro]
INDEXED_EXTRACTIONS = TSV
FIELD_NAMES = field1, field2, field3, field4
splunk[/opt/splunk/etc/apps/bro/local] #

This did not work, I am sorry.

[jkat54]

I noticed this is in /opt/splunk... Do you have a distributed environment?

Can you explain the integration's architecture like below?

bro logs -> universal forwarder -> indexer -> search heads

or maybe

bro logs -> indexer & search head

etc.

[jkat54]

I find it hard to believe the bro logs dont parse correctly with the splunk app for bro IDS. Did you follow the installation instructions completely?

Do you have a distributed splunk install? If so, where did you put the props?

[brent_weaver]

I did follow the instructions, which clearly state that it is compatible with =

[richgalloway]

Some sample data would be helpful.

[brent_weaver]

A sample data would be:

1/3/2016 11:05:05\tfield1\tfield2\tfield3

please note that I cannot put the tabs in there so I used the \t esc character. This is just a sample of data for testing purposes.
Thanks!