Getting Data In

What props.conf and transforms.conf settings I need to onboard my XML logs? and on which instances?

trabz777
Engager

trabz777_0-1643197346946.png

This ^ is sample xml log file that I want to onboard. Please guide me about the settings which I should set in order to properly input this data. Also tell me on which instances the settings (props.conf and transforms.conf) are required. I am running a Distributed system with indexer clustering. 

Labels (3)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

First You should test this with sample data on your local dev instance. This is the easiest way to integrate data source to splunk. 

On your local instance start with

  1. Settings -> Add Data -> Monitor/Upload
  2. Select source file from your local disk
  3. Configure the next parts
    1. Event Breaks (Regex ([\n\r]+)\s*<Interceptor>)
    2. Timestamp: Advanced
      1. Format: %Y-%m-%d</ActionDate>\n\s*<ActionTime>%H:%M%S (check with your actual data)
      2. Prefix: <ActionDate>
      3. Lookahead: enough long to match Format
    3. Advanced: If something is needed

When you are happy what you see on your preview, then "Save As" a new sourcetype. Also you can copy those with link "Copy to clipboard".

Then add that props.conf into the first full Splunk Enterprise instance on path from your source system to indexers. And remember restart that instance.

I prefer to create own TA for those config and then distribute that TA where it is needed.

r. Ismo

View solution in original post

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

First You should test this with sample data on your local dev instance. This is the easiest way to integrate data source to splunk. 

On your local instance start with

  1. Settings -> Add Data -> Monitor/Upload
  2. Select source file from your local disk
  3. Configure the next parts
    1. Event Breaks (Regex ([\n\r]+)\s*<Interceptor>)
    2. Timestamp: Advanced
      1. Format: %Y-%m-%d</ActionDate>\n\s*<ActionTime>%H:%M%S (check with your actual data)
      2. Prefix: <ActionDate>
      3. Lookahead: enough long to match Format
    3. Advanced: If something is needed

When you are happy what you see on your preview, then "Save As" a new sourcetype. Also you can copy those with link "Copy to clipboard".

Then add that props.conf into the first full Splunk Enterprise instance on path from your source system to indexers. And remember restart that instance.

I prefer to create own TA for those config and then distribute that TA where it is needed.

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...