Splunk Enterprise

Why is DHCP log not parsing properly?

Akmal57
Path Finder

Hi, i have parsing issue on window DHCP log. Im using splunk add on for Window DHCP. The raw log are as below.

1030,05/16/23,15:24:03,0 DHCPV6 Stateless client records purged,,,,,,,,,,

25,05/16/23,15:24:03,0 leases expired and 0 leases deleted,,,,,0,6,,,,,,,,,0

25,05/16/23,15:24:03,0 leases expired and 0 leases deleted,,,,,0,6,,,,,,,,,0

24,05/16/23,15:24:03,Database Cleanup Begin,,,,,0,6,,,,,,,,,0

11030,05/16/23,14:24:03,0 DHCPV6 Stateless client records purged,,,,,,,,,,

25,05/16/23,14:24:03,0 leases expired and 0 leases deleted,,,,,0,6,,,,,,,,,0

25,05/16/23,14:24:03,0 leases expired and 0 leases deleted,,,,,0,6,,,,,,,,,0

it seems like doesn't have any information.

Please assist for this issue.

Thank You 

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

I installed that app and loaded your data.  It appears to parse just fine.

richgalloway_0-1684344812981.png

As far as I can tell, the empty fields are empty because they're not in the sample events.

The TA expects these fields in this order.

"id","date","time","description","ip","nt_host","mac","user","transaction_id","qresult","probation_time","correlation_id","dhcid","vendorclass_hex","vendor_ascii","userclass_hex","userclass_ascii","relay_agent","dns_reg_error"

 If you're getting results like these then perhaps consider re-installing the TA.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Which app are you using (please share the splunkbase URL)?  Is it installed on your indexers and heavy forwarders?  Did you restart them after installation?

It seems like the data doesn't match the props supplied by the app.  You may need to modify settings to match your data.  Knowing the exact app will help us be more specific.

---
If this reply helps you, Karma would be appreciated.
0 Karma

Akmal57
Path Finder

the app URL is as below:

Microsoft Windows DHCP addon for Splunk | Splunkbase

the app installed in search head and indexers, the data source is from UF. Already restart after the app installation.

Please advise, thank you. 

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I installed that app and loaded your data.  It appears to parse just fine.

richgalloway_0-1684344812981.png

As far as I can tell, the empty fields are empty because they're not in the sample events.

The TA expects these fields in this order.

"id","date","time","description","ip","nt_host","mac","user","transaction_id","qresult","probation_time","correlation_id","dhcid","vendorclass_hex","vendor_ascii","userclass_hex","userclass_ascii","relay_agent","dns_reg_error"

 If you're getting results like these then perhaps consider re-installing the TA.

---
If this reply helps you, Karma would be appreciated.

Akmal57
Path Finder

Hi richgalloway,

Thank you for the reply. The actual event should be containing user's information but in splunk raw event we didn't receive much information. 

i think we need to check the log from the DCHP server itself.

Thank you for your assist.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...