Reporting

Exchange Activesync IIS logs - SEDCMD

drarum
Engager

I'm pulling Exchange Activesync information from our IIS logs on OWA and I want to perform a transform on Apple devices to make readability easier (To allow us to determine which HW/SW version the user is running). It's fairly simple, but I'm new to Splunk and something isn't working quite right.

I created a props.conf file here: $SPLUNK/etc/system/local/props.conf . This file isn't complete, I just filled in a few values for testing, but the search results still show the unmodified logs.

[owa]

SEDCMD-activesync=s/Apple-iPhone3C1/Apple-iPhone4/g

SEDCMD-activesync=s/Apple-iPhone2C1/Apple-iPhone3GS/g

SEDCMD-activesync=s/Apple-iPhone1C2/Apple-iPhone3G/g

For the first transformation, I want to substitute "Apple-iPhone3C1" for "Apple-iPhone4" in the "owa" log.

Thank you.

Tags (1)

drarum
Engager

Thanks, I decided to go with the rex/sed searching and conversion. You were right about props.conf. I was supposed to be saving this to the universal forwarder that was indexing the data, but I was saving props.conf on the actual Splunk server after the data had already been indexed.

0 Karma

mslvrstn
Communicator

What you are doing there is redefining the same property over and over.
Only the last one will have any effect, although that one should have worked for the 3G.

If you want to apply all of the edits, space separate them in one property, like:

SEDCMD-activesync=s/Apple-iPhone3C1/Apple-iPhone4/g s/Apple-iPhone2C1/Apple-iPhone3GS/g s/Apple-iPhone1C2/Apple-iPhone3G/g
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...