Getting Data In

event tagging ..Multiple format lines in same log file

desi-indian
Path Finder

Hi ,
I am trying to do a field extraction for a log ...the issue I am facing is the field lay out remains constant works fine for 90 % time but for remaining 10 % the log format changes

Example :

when I have a message line with "Authenticated" In there the user_ID is 9 th field

BUT when I have "LOGOFF" in the line the User_ID is coming in as 7 th field .

How do I define my props/transforms so I am capturing ALL User_IDs irrespective If it comes in 7 th field or 9 th field ?

Thanks for the help !

0 Karma

aalanisr26
Path Finder

if for example you have:

First Kind of event,Some More field,Authentication,7,More,More
Second Kind of event,Data,Data,Data,Data,Data,Data,LogOFF,7,More,More

if you want to get the 7

(Authentication\,\d+|LogOFF\,\d)

0 Karma

lguinn2
Legend

And a few lines from a log file, showing the alternate formats, would be helpful, too. You should anonymize any identifying data. Thanks!

0 Karma

ftk
Motivator

Can you post your current extractions from props.conf and transforms.conf?

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...