Splunk Enterprise

Why is DHCP log not parsing properly?

Akmal57
Path Finder

Hi, i have parsing issue on window DHCP log. Im using splunk add on for Window DHCP. The raw log are as below.

1030,05/16/23,15:24:03,0 DHCPV6 Stateless client records purged,,,,,,,,,,

25,05/16/23,15:24:03,0 leases expired and 0 leases deleted,,,,,0,6,,,,,,,,,0

25,05/16/23,15:24:03,0 leases expired and 0 leases deleted,,,,,0,6,,,,,,,,,0

24,05/16/23,15:24:03,Database Cleanup Begin,,,,,0,6,,,,,,,,,0

11030,05/16/23,14:24:03,0 DHCPV6 Stateless client records purged,,,,,,,,,,

25,05/16/23,14:24:03,0 leases expired and 0 leases deleted,,,,,0,6,,,,,,,,,0

25,05/16/23,14:24:03,0 leases expired and 0 leases deleted,,,,,0,6,,,,,,,,,0

it seems like doesn't have any information.

Please assist for this issue.

Thank You 

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

I installed that app and loaded your data.  It appears to parse just fine.

richgalloway_0-1684344812981.png

As far as I can tell, the empty fields are empty because they're not in the sample events.

The TA expects these fields in this order.

"id","date","time","description","ip","nt_host","mac","user","transaction_id","qresult","probation_time","correlation_id","dhcid","vendorclass_hex","vendor_ascii","userclass_hex","userclass_ascii","relay_agent","dns_reg_error"

 If you're getting results like these then perhaps consider re-installing the TA.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Which app are you using (please share the splunkbase URL)?  Is it installed on your indexers and heavy forwarders?  Did you restart them after installation?

It seems like the data doesn't match the props supplied by the app.  You may need to modify settings to match your data.  Knowing the exact app will help us be more specific.

---
If this reply helps you, Karma would be appreciated.
0 Karma

Akmal57
Path Finder

the app URL is as below:

Microsoft Windows DHCP addon for Splunk | Splunkbase

the app installed in search head and indexers, the data source is from UF. Already restart after the app installation.

Please advise, thank you. 

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I installed that app and loaded your data.  It appears to parse just fine.

richgalloway_0-1684344812981.png

As far as I can tell, the empty fields are empty because they're not in the sample events.

The TA expects these fields in this order.

"id","date","time","description","ip","nt_host","mac","user","transaction_id","qresult","probation_time","correlation_id","dhcid","vendorclass_hex","vendor_ascii","userclass_hex","userclass_ascii","relay_agent","dns_reg_error"

 If you're getting results like these then perhaps consider re-installing the TA.

---
If this reply helps you, Karma would be appreciated.

Akmal57
Path Finder

Hi richgalloway,

Thank you for the reply. The actual event should be containing user's information but in splunk raw event we didn't receive much information. 

i think we need to check the log from the DCHP server itself.

Thank you for your assist.

Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...