Event cannot be separated.

[SJGwak]

I want to separate events by date

I want to isolate red highlights that have similar formats.
I don't know how.

I would appreciate it if you could tell me how.

[isoutamo]

Hi

you need to do basic data source onboarding process. There are lot of different instructions how to do it. 

Here is some links:

• https://lantern.splunk.com/Splunk_Success_Framework/Data_Management/Data_onboarding_workflow
• https://conf.splunk.com/files/2017/slides/data-onboarding-where-do-i-begin.pdf
• https://data-findings.com/wp-content/uploads/2024/04/Data-OnBoarding-2024-04-03.pdf

There are many many more presentations which you can easily found.

r. Ismo

[SJGwak]

The problem is that that _row does not correspond to linecount=2, but is recognized as 1.

I will give you one _row data as an example.

(_row recognized as one)
1333561147.74 48957 131.178.233.243 TCP_DENIED/403 1914 GET http://bewfsnfwka.net/  [email protected] NONE/- - BLOCK_AMW_REQ-DefaultGroup-Demo_Clients-NONE-NONE-NONE <nc,dns,-9,"Trojan- Downloader .Gen",100,13689,586638,-,-,-,-,-,-,-,-,nc,-> - -1262356487.060 16922 131.178.233.243 TCP_REFRESH_HIT/200 474 GET http://damtare.by . ru/id.txt [email protected] DIRECT/damtare.by.ru text/html DEFAULT_CASE-DefaultGroup-Demo_Clients-NONE-NONE-DefaultRouting <IW_scty,-6.9,0,-,-,-,-,0,- ,-,-,-,-,-,-,IW_scty,-> - -

()
1333561147.74 48957 131.178.233.243 TCP_DENIED/403 1914 GET http://bewfsnfwka.net/  [email protected] NONE/- - BLOCK_AMW_REQ-DefaultGroup-Demo_Clients-NONE-NONE-NONE <nc,dns,-9,"Trojan- Downloader .Gen",100,13689,586638,-,-,-,-,-,-,-,-,nc,-> - -
(2)
1262356487.060 16922 131.178.233.243 TCP_REFRESH_HIT/200 474 GET http://damtare.by.ru/id.txt  [email protected] DIRECT/damtare.by.ru text/html DEFAULT_CASE-DefaultGroup-Demo_Clients-NONE-NONE-DefaultRout ing < IW_scty,-6.9,0,-,-,-,-,0,-,-,-,-,-,-,-,IW_scty,-> - -

(1), (2) How do I separate them into each _row?
Please give an example of a regular expression that needs to be separated.

thank you,