Splunk Enterprise

How can I write a proper props for sample logs?

Ash1
Communicator

Below are the sample logs, here i have 2 types of logs formats.

for json logs i have given this props:
[sourcetype]
INDEXED_EXTRACTIONS=json
KV_MODE=none
SHOULD_LINEMERGE=true
TIMESTAMP_FILEDS=timestamp
LINE_BREAKER=([\r\n]+)

how to write props so that both logs we can capture.

 

{"timestamp": "2022-02-12T01:22:13.345Z", "application status", host:app.cpm-134678, application/json: 0drem345msdsmmnn, "authorization"***************
********************************************************************
************************************************user interface, application conenction-ok "**********"

 

 

 

 

ClientID: NA
host: json-edrtyu
level: app-apiInfo
message: clientid: undefined, userid: unknown
timestamp: 2022-01-12T01:09:44.344Z

 

 

 

{"timestamp": "2022-02-14T01:22:13.123Z", "application status", host:app.cpm-134678, application/json: 0drem345msdsmmnn, "authorization"***************
********************************************************************
************************************************user interface, application conenction-ok "**********"

 

 

 

ClientID: NA
host: json-edrtyu
level: app-apiInfo
message: clientid: undefined, userid: unknown
timestamp: 2022-01-12T01:09:44.34

 


 

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...