Getting Data In

trouble breaking log events

JeffTanYH
Engager

I have several text format log files in which I need help in linebreaking them into the appropriate events that I need. This is an exmaple of what my file looks like:

====================================================

LOGS_BEGIN: DO_LOG

====================================================

====================================================

-rw------- 1 root root 3505 Apr 23 12:58 /var/adm/sulog

====================================================

SU 02/12 16:53 - pts/1 hkim-root

SU 02/12 16:53 + pts/1 hkim-root

SU 02/13 13:10 + ??? root-sys

SU 02/16 13:10 + ??? root-sys

SU 02/17 13:10 + ??? root-sys

SU 02/20 13:10 + ??? root-sys

====================================================

====================================================

-rw------- 1 root root 99999999 Apr 24 15:25 /var/log/messages

====================================================

Apr 24 14:30:01 999999999999 crond(pam_unix)[13043]: session opened for user root by (uid=0)

Apr 24 14:30:01 999999999999 crond(pam_unix)[13045]: session opened for user root by (uid=0)

Apr 24 14:30:01 999999999999 su(pam_unix)[13049]: session opened for user iscan by (uid=0)

Apr 24 14:30:01 999999999999 crond(pam_unix)[13043]: session closed for user root

====================================================

====================================================

-rw------- 1 root sys 2984 Apr 11 2006 /var/adm/loginlog

====================================================

vkaliya:/dev/pts/1:Wed May 4 11:14:34 2005

vkaliaya:/dev/pts/1:Wed May 4 11:14:43 2005

vkaliya:/dev/pts/1:Wed May 4 11:14:34 2005

vkaliaya:/dev/pts/1:Wed May 4 11:14:43 2005

vkaliya:/dev/pts/1:Wed May 4 11:14:55 2005

vkaliya:/dev/pts/1:Wed May 4 11:15:06 2005

====================================================

====================================================

I need to be able to filter out the top part of the log,which consist of the 1st line till the 6th line (shown below)this applies to the messagelog and loginlog as well

====================================================

LOGSBEGIN: DOLOG

====================================================

====================================================

-rw------- 1 root root 3505 Apr 23 12:58 /var/adm/sulog

====================================================

After which,I will need each and every line to be a seperate event (shown below)

SU 02/15 10:28 + pts/1 hkim-root

SU 02/15 13:10 + ??? root-sys

I would also have to filter out the last part of the log(shown below)

====================================================

====================================================

I have tried several props.conf but it doesn't to be working!! Please help me!
TAKE NOTE: at the loginlog section,the time format is different from the message and sulog section!!!!

0 Karma

emcollections
New Member
0 Karma

emcollections
New Member
0 Karma

emcollections
New Member
0 Karma

emcollections
New Member
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Splunk App Dev Quarterly Roundup: AI, Agents, and Innovation!

Another quarter, another wave of innovation. From complex integrations to pushing the limits ...

Federated Search for Dynamic Data Self Storage Is Now Generally Available on Splunk ...

 Splunk is excited to announce the General Availability of Federated Search for Dynamic Data Self Storage ...

Index This | What has many keys but can’t unlock a door?

July 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...