I dont know why I cannot get this to work BUT, I have a log that is TSV and I want to carve out the fields. Beyond TSV the first field needs to be parsed as colon separated and my timestamp is the second part of that first field. How do I accomplish this? These are actually bro logs that do not parse correctly with he Spunk App for bro IDS. This app is for v2.4< and we are on 2.5. Any help is much appreciated!
A sample data would be:
please note that I cannot put the tabs in there so I used the \t esc character. This is just a sample of data for testing purposes.
I find it hard to believe the bro logs dont parse correctly with the splunk app for bro IDS. Did you follow the installation instructions completely?
Do you have a distributed splunk install? If so, where did you put the props?
Here's one way, put this props on your forwarders & indexers.
[sourcetypeName] INDEXED_EXTRACTIONS=TSV FIELD_NAMES = _time, fielda, fieldb, fieldc
Here is my props.conf:
splunk[/opt/splunk/etc/apps/bro/local] # cat props.conf
INDEXEDEXTRACTIONS = TSV
FIELDNAMES = field1, field2, field3, field4
This did not work, I am sorry.
I noticed this is in /opt/splunk... Do you have a distributed environment?
Can you explain the integration's architecture like below?
bro logs -> universal forwarder -> indexer -> search heads
bro logs -> indexer & search head