Splunk Enterprise

Suggestions for filtering nodejs logs

pkeller
Contributor

22:13:06.901Z INFO my-portal: blah : blah - success
tracker: {
"trackId": "foo",
"hashedAccountId": "bar",
"ip": "127.0.0.1",
"queryUrl": "http://my.domain.com/aluminum/batPreferences/txm",
"queryMethod": "GET",
"elapsed": 91.561
}

The nodejs output looks kinda like what's shown above. Any suggestions for parsing this so that I can view the syntax highlighted json would be appreciated. I've tried a transforms to reassign the INFO line to a separate sourcetype, but that doesn't change the fact that I only see the raw text in my search.

[nodejs:all]
KV_MODE = json
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = false
TRUNCATE = 0
LINE_BREAKER = ([\r\n]+)(\d{2}:\d{2}:\d{2})
TRANSFORMS-strip_INFO = strip_INFO

transforms.conf
[strip_INFO]
REGEX = ^\d{2}:\d{2}:\d{2}.\d{3}Z
FORMAT = sourcetype::nodejs_out
DEST_KEY = MetaData:Sourcetype

Clearly this doesn't work, but I'm a bit stumped.

Thank you.

Labels (1)
0 Karma
1 Solution

to4kawa
Ultra Champion
LINE_BREAKER = (){|}()

and remove extra events

View solution in original post

0 Karma

to4kawa
Ultra Champion
LINE_BREAKER = (){|}()

and remove extra events

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...