Monitoring Splunk

Why does the Ping audit format break with props?

ddrillic
Ultra Champion

The audit file has this format -

# 18/Apr/2019:14:59:38.341 -0500; ....
dn: dc=....
changetype: modify
replace: ds-sync-state
ds-sync-state: .....

# 18/Apr/2019:15:01:32.404 -0500; ....
dn: uid=Testing123,....
changetype: delete

# 18/Apr/2019:15:01:33.352 -0500; ....
dn: dc=....
changetype: modify
replace: ds-sync-state
ds-sync-state: .....

In props.conf I have -

[ldap:....]
disabled=false
SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n]+)\#\s+\S+
TIME_FORMAT=%d/%b/%Y:%H:%M:%S.%3N %z
TIME_PREFIX=^\#\s+
MAX_TIMESTAMP_LOOKAHEAD=50
TRUNCATE=10000

The parsing doesn't always work and I end up with events with multiple lines such as -

# 18/Apr/2019:14:59:38.341 -0500; ....

This line should be only the starting line of each event.

What am I missing?

Tags (2)
0 Karma
1 Solution

somesoni2
Revered Legend

Give this a try

[ldap:....]
 disabled=false
 SHOULD_LINEMERGE=false
 LINE_BREAKER=([\r\n]+)(?=\s*\#\s+\d+\/\w+)
 TIME_FORMAT=%d/%b/%Y:%H:%M:%S.%3N %z
 TIME_PREFIX=^\s*#\s+
 MAX_TIMESTAMP_LOOKAHEAD=30
 TRUNCATE=10000

View solution in original post

somesoni2
Revered Legend

Give this a try

[ldap:....]
 disabled=false
 SHOULD_LINEMERGE=false
 LINE_BREAKER=([\r\n]+)(?=\s*\#\s+\d+\/\w+)
 TIME_FORMAT=%d/%b/%Y:%H:%M:%S.%3N %z
 TIME_PREFIX=^\s*#\s+
 MAX_TIMESTAMP_LOOKAHEAD=30
 TRUNCATE=10000

View solution in original post

ddrillic
Ultra Champion

Gorgeous @somesoni2 - what might have gone wrong with the original props set up? Does _internal capture incorrect set-ups, like my original one?

0 Karma

somesoni2
Revered Legend

Main change I did was to update LINE_BREAKER to handle possible spaces before # in the raw data. Again, unless there is a syntax error, all regex are valid for Splunk and you'll not see any error (Splunk can't decide if you want to merge those events or not).

0 Karma

ddrillic
Ultra Champion

Perfect - makes sense.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!