Splunk Search

Correlate data name to text line // Lookup maybe ?

klischatb
Path Finder

Hello,

i have the following problem.
When i start my bukkit server (Minecraft) and join with a Player, the server will write i a log file with following text:

[12:56:48] [User Authenticator #1/INFO]: UUID of player PlayerName is 42a6cc6a-0253-4c65-baa2-74573573tds

In addition, he creates a file with the name of the UUID, for example:
42a6cc6a-0253-4c65-baa2-74573573tds.json
In this file everything is saved what the user has done on the server.

Example of the json file:

14.10.19 11:42:05,000   
{ [-]
   DataVersion: 1976
   stats: { [-]
     minecraft:crafted: { [-]
       minecraft:oak_planks: 4
     }
     minecraft:custom: { [+]
     }
     minecraft:killed_by: { [-]
       minecraft:creeper: 1
       minecraft:skeleton: 5
       minecraft:zombie: 12
     }
     minecraft:mined: { [-]
       minecraft:dirt: 7
       minecraft:grass: 38
       minecraft:grass_block: 24
       minecraft:oak_log: 2
       minecraft:poppy: 5
     }
     minecraft:picked_up: { [+]
     }
     minecraft:used: { [+]
     }
   }
}
Als Rohtext anzeigen
host = splunkcraft 
source = /home/splunker/minecraft/world/stats/42a6cc6a-0253-4c65-baa2-7457357cf96a.json
sourcetype = _json

Question:
Is it possible to Correlate the filename with the line from the log file.
I want this cause the .Json file dont have the Playername in it.

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi klischatb,
when you ingest the UUID files, the filename is stored in the "source" field that can be used to correlate it to the the main log.
In other words you could have something like this:

index=my_index sourcetype=minecraft OR sourcetype=uuid
| rex field=source "^\/(\w*\/)*(?<uuid_source>[^\.]*).json$"
| ...

Ciao.
Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi klischatb,
when you ingest the UUID files, the filename is stored in the "source" field that can be used to correlate it to the the main log.
In other words you could have something like this:

index=my_index sourcetype=minecraft OR sourcetype=uuid
| rex field=source "^\/(\w*\/)*(?<uuid_source>[^\.]*).json$"
| ...

Ciao.
Giuseppe

View solution in original post

klischatb
Path Finder

it helped a lot,
thank you

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.