Security & the Enterprise
Much secured. So patch!

Issue with Automatic field extraction

swathiadireddy
Loves-to-Learn Everything

Below are the two different formats of the same events. With the first format the system is automatically extracting the fields and with the second format it is not automatically extracting the fields like fields as first format. Second format of data is more helpful with LogID (which is highlighted in red) included in the message.

Any Idea how to fix the automatic field extraction instead of doing manual field extraction or using rex when required ? Does any configuration changes are required on Splunk ? On Cisco device its just a filter change.

1. 288 <158>1 2020-04-22T23:46:10-04:00 171.171.148.171 Cisco: - - - 2020-04-22 23:46:10 - ABC_Device - [101.172.173.75] System()[] - User Accounts modified. Removed username ZYXY from authentication server AD-CAG.

2. 288 <158>1 2020-08-11T18:46:37-04:00 171.171.148.171 Cisco: - - - id=firewall time="2020-08-11 18:46:37" pri=6 fw=101.172.173.75 vpn=ABC_Device user=System realm="" roles=""
type=mgmt msg="ADM222222: User Accounts modified. Removed username ZYXY from authentication server AD-CAG."

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust
Please share the props.conf settings for that sourcetype.
---
If this reply helps you, Karma would be appreciated.
0 Karma

swathiadireddy
Loves-to-Learn Everything

There are no changes made in Splunk. Its the same. Only changes were made on Cisco devices.

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust
Yes and now there have to be changes to Splunk, but only after we know what the current settings are.
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Detector Best Practices: Static Thresholds

Introduction In observability monitoring, static thresholds are used to monitor fixed, known values within ...

Expert Tips from Splunk Education, Observability in Action, Plus More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Changes to Splunk Instructor-Led Training Completion Criteria

We’re excited to share an update to our instructor-led training program that enhances the learning experience ...