Getting Data In

label fields in a flat file

udiggity
New Member

I have activity files from a vpn radius server and I'd like to label the fields as they go into splunk... I'm not even sure where to look for this info at, can someone help point me in the right direction?

Essentially I have this

03/07/2011","14:06:53","VPN","Start","username","7","common name","IP address","1878", etc and I'd like those fields to become labeled and searchable in the index. Thanks for any help you can give, I'm very new to splunk and fumbling my way through.

Tags (2)
0 Karma
1 Solution

jasonnadeau
Explorer

You can assign a sourcetype to those VPN records and then perform field extraction on those fields you wish. I would first start by assigning the sourcetype field to the inputs.conf that collects those logs. I am assuming they are on disk so you would configure something like this

[monitor:///var/log/VPN/logfile.log]]
sourcetype=VPN_logs

Then use the Interactive field extraction specified here. There are some other ways to extract fields based upon host or based upon regular expressions. I choose to use sourcetype to do my field extractions because I can easily add another host or source of similar log files in the future. Similarly people use object groups in firewalls rather than single IP address entries because its easier to modify in the future.

View solution in original post

0 Karma

jasonnadeau
Explorer

You can assign a sourcetype to those VPN records and then perform field extraction on those fields you wish. I would first start by assigning the sourcetype field to the inputs.conf that collects those logs. I am assuming they are on disk so you would configure something like this

[monitor:///var/log/VPN/logfile.log]]
sourcetype=VPN_logs

Then use the Interactive field extraction specified here. There are some other ways to extract fields based upon host or based upon regular expressions. I choose to use sourcetype to do my field extractions because I can easily add another host or source of similar log files in the future. Similarly people use object groups in firewalls rather than single IP address entries because its easier to modify in the future.

0 Karma

udiggity
New Member

Thanks for the reply, sorry I just got back in to the office, so I will try this now. Thanks again, I will let you know how it goes.

0 Karma
Get Updates on the Splunk Community!

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...