Getting Data In

trouble breaking log events

JeffTanYH
Engager

I have several text format log files in which I need help in linebreaking them into the appropriate events that I need. This is an exmaple of what my file looks like:

====================================================

LOGS_BEGIN: DO_LOG

====================================================

====================================================

-rw------- 1 root root 3505 Apr 23 12:58 /var/adm/sulog

====================================================

SU 02/12 16:53 - pts/1 hkim-root

SU 02/12 16:53 + pts/1 hkim-root

SU 02/13 13:10 + ??? root-sys

SU 02/16 13:10 + ??? root-sys

SU 02/17 13:10 + ??? root-sys

SU 02/20 13:10 + ??? root-sys

====================================================

====================================================

-rw------- 1 root root 99999999 Apr 24 15:25 /var/log/messages

====================================================

Apr 24 14:30:01 999999999999 crond(pam_unix)[13043]: session opened for user root by (uid=0)

Apr 24 14:30:01 999999999999 crond(pam_unix)[13045]: session opened for user root by (uid=0)

Apr 24 14:30:01 999999999999 su(pam_unix)[13049]: session opened for user iscan by (uid=0)

Apr 24 14:30:01 999999999999 crond(pam_unix)[13043]: session closed for user root

====================================================

====================================================

-rw------- 1 root sys 2984 Apr 11 2006 /var/adm/loginlog

====================================================

vkaliya:/dev/pts/1:Wed May 4 11:14:34 2005

vkaliaya:/dev/pts/1:Wed May 4 11:14:43 2005

vkaliya:/dev/pts/1:Wed May 4 11:14:34 2005

vkaliaya:/dev/pts/1:Wed May 4 11:14:43 2005

vkaliya:/dev/pts/1:Wed May 4 11:14:55 2005

vkaliya:/dev/pts/1:Wed May 4 11:15:06 2005

====================================================

====================================================

I need to be able to filter out the top part of the log,which consist of the 1st line till the 6th line (shown below)this applies to the messagelog and loginlog as well

====================================================

LOGSBEGIN: DOLOG

====================================================

====================================================

-rw------- 1 root root 3505 Apr 23 12:58 /var/adm/sulog

====================================================

After which,I will need each and every line to be a seperate event (shown below)

SU 02/15 10:28 + pts/1 hkim-root

SU 02/15 13:10 + ??? root-sys

I would also have to filter out the last part of the log(shown below)

====================================================

====================================================

I have tried several props.conf but it doesn't to be working!! Please help me!
TAKE NOTE: at the loginlog section,the time format is different from the message and sulog section!!!!

0 Karma

emcollections
New Member
0 Karma

emcollections
New Member
0 Karma

emcollections
New Member
0 Karma

emcollections
New Member
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26

You use Splunk every day, come and help shape what's next.  Save Your Seat: Product-Focused Sessions at ...

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

The Problem: Too Many Alerts, Too Little Context Security operations teams running Splunk Enterprise Security ...

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas

Watch Now Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas     Do you ever feel ...