- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Issue with Automatic field extraction
Below are the two different formats of the same events. With the first format the system is automatically extracting the fields and with the second format it is not automatically extracting the fields like fields as first format. Second format of data is more helpful with LogID (which is highlighted in red) included in the message.
Any Idea how to fix the automatic field extraction instead of doing manual field extraction or using rex when required ? Does any configuration changes are required on Splunk ? On Cisco device its just a filter change.
1. 288 <158>1 2020-04-22T23:46:10-04:00 171.171.148.171 Cisco: - - - 2020-04-22 23:46:10 - ABC_Device - [101.172.173.75] System()[] - User Accounts modified. Removed username ZYXY from authentication server AD-CAG.
2. 288 <158>1 2020-08-11T18:46:37-04:00 171.171.148.171 Cisco: - - - id=firewall time="2020-08-11 18:46:37" pri=6 fw=101.172.173.75 vpn=ABC_Device user=System realm="" roles=""
type=mgmt msg="ADM222222: User Accounts modified. Removed username ZYXY from authentication server AD-CAG."
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
There are no changes made in Splunk. Its the same. Only changes were made on Cisco devices.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If this reply helps you, Karma would be appreciated.