rebuild a syslog event

[asabatini]

Hi Folks,

I have a quick question.

currently I have a syslog event and I need to see in splunk the raw data the info in different order:

Example

original syslog

(?<field1>REGEX),(?<field2>REGEX),(?<field3>REGEX),  etc.......

what I want to see indexed in splunk

(?<field1>REGEX),(?<field3>REGEX),,(?<TIMESTAP>REGEX),(?<field2>REGEX).

I tried with SED command in props.conf is really useful to clean the data but not to reorder the info.

Thanks in advance

Alex

[scelikok]

Hi @asabatini,

I think the problem is name-capturing groups in REGEX. Using name-capturing groups will already create a field without a FORMAT parameter. 

You can try one of the below options;

Using name-capturing groups in REGEX;

[group1]
REGEX = (?<group1>.+\s\-\s\-\s\-\s).*.auditID.:.(?<group2>[\w-]+)..*requestURI.:.(?<group4>[^,]+).+username.:.(?<group5>[^,]+).+sourceIPs....(?<group3>\d+.\d+.\d+.\d+)

Without name-capturing groups in REGEX;

[group1]
REGEX = (.+\s\-\s\-\s\-\s).*.auditID.:.([\w-]+)..*requestURI.:.([^,]+).+username.:.([^,]+).+sourceIPs....(\d+.\d+.\d+.\d+)
FORMAT = group1::$1, group2::$2, group5::$3, group3::$4, group4::$5

[scelikok]

Hi @asabatini,

You can reorder or modify raw data using transforms,  you need to capture parts of the messages and reorder them like $1$3$2, etc.

please see the document below;

https://docs.splunk.com/Documentation/Splunk/9.0.3/Data/Anonymizedata#Configure_the_transforms.conf_...

[asabatini]

Hi @scelikok 

I agree with you, I would show you my props and transforms conf file

props.conf

[custom_syslog]
transforms-rebuild = group1
SHOULD_LINEMERGE = false

Transforms

[group1]
REGEX = (?<group1>.+\s\-\s\-\s\-\s).*.auditID.:.(?<group2>[\w-]+)..*requestURI.:.(?<group3>[^,]+).+username.:.(?<group4>[^,]+).+sourceIPs....(?<group5>\d+.\d+.\d+.\d+)
FORMAT = group1::$1, group2::$2, group5::$3, group3::$4, group4::$5

Did I forget something in the conf files?

Regards

Alessandro

[PickleRick]

Hi Alessandro.

If that's your actual copy-pasted excerpt from props.conf you have

transforms-rebuild = group1

instead of

TRANSFORMS-rebuild = group1

(yes, case does matter here)