Getting Data In

trouble breaking log events

JeffTanYH
Engager

I have several text format log files in which I need help in linebreaking them into the appropriate events that I need. This is an exmaple of what my file looks like:

====================================================

LOGS_BEGIN: DO_LOG

====================================================

====================================================

-rw------- 1 root root 3505 Apr 23 12:58 /var/adm/sulog

====================================================

SU 02/12 16:53 - pts/1 hkim-root

SU 02/12 16:53 + pts/1 hkim-root

SU 02/13 13:10 + ??? root-sys

SU 02/16 13:10 + ??? root-sys

SU 02/17 13:10 + ??? root-sys

SU 02/20 13:10 + ??? root-sys

====================================================

====================================================

-rw------- 1 root root 99999999 Apr 24 15:25 /var/log/messages

====================================================

Apr 24 14:30:01 999999999999 crond(pam_unix)[13043]: session opened for user root by (uid=0)

Apr 24 14:30:01 999999999999 crond(pam_unix)[13045]: session opened for user root by (uid=0)

Apr 24 14:30:01 999999999999 su(pam_unix)[13049]: session opened for user iscan by (uid=0)

Apr 24 14:30:01 999999999999 crond(pam_unix)[13043]: session closed for user root

====================================================

====================================================

-rw------- 1 root sys 2984 Apr 11 2006 /var/adm/loginlog

====================================================

vkaliya:/dev/pts/1:Wed May 4 11:14:34 2005

vkaliaya:/dev/pts/1:Wed May 4 11:14:43 2005

vkaliya:/dev/pts/1:Wed May 4 11:14:34 2005

vkaliaya:/dev/pts/1:Wed May 4 11:14:43 2005

vkaliya:/dev/pts/1:Wed May 4 11:14:55 2005

vkaliya:/dev/pts/1:Wed May 4 11:15:06 2005

====================================================

====================================================

I need to be able to filter out the top part of the log,which consist of the 1st line till the 6th line (shown below)this applies to the messagelog and loginlog as well

====================================================

LOGSBEGIN: DOLOG

====================================================

====================================================

-rw------- 1 root root 3505 Apr 23 12:58 /var/adm/sulog

====================================================

After which,I will need each and every line to be a seperate event (shown below)

SU 02/15 10:28 + pts/1 hkim-root

SU 02/15 13:10 + ??? root-sys

I would also have to filter out the last part of the log(shown below)

====================================================

====================================================

I have tried several props.conf but it doesn't to be working!! Please help me!
TAKE NOTE: at the loginlog section,the time format is different from the message and sulog section!!!!

0 Karma

emcollections
New Member
0 Karma

emcollections
New Member
0 Karma

emcollections
New Member
0 Karma

emcollections
New Member
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Manage Edge Processor pipelines end to end with APIs

This guide uses the Data Management APIs to create an Edge Processor, onboard one instance, deploy a pipeline ...

Splunk Brings Proof of Control to Digital Asset Transfers

Digital assets now sit inside the core of financial services. HSBC launched its Tokenized Deposit Service in ...

Manage Ingest Processor pipelines end to end with APIs

This guide uses the Data Management APIs to create an Ingest Processor pipeline, deploy it to the ...