Splunk Search

Creating a Log for use with Splunk

eulalie
New Member

We have an application that does NOT generate it's own logs. We are in a position where we can get the logs generated on the fly to be able to do a report showing a timeline based on logs from 4 systems.

The applications owner can generate the logs in almost any format we want. I had him generate a log with the format:

FIELD1="VALUE1" FIELD2="VALUE2"

Where field 1 happens to be the event time and field 2 happens to be username. I added OR FIELD2=VALUE to my search and added the fields for FIELD1 and FIELD2 to my | table.

I have two problems. I assume the second is a result of the first. When I look at that file only in splunk it shows me the events and it seems to extract the fields, however when I do a search it does not. The other issue is that it doens't appear to be viewing FIELD1 as the even date and time.. it's just another field with some data in it.

The application can give me CSV or TXT files. How should I get it formatted for Splunk to know what we're going for?

Tags (1)
0 Karma

Damien_Dallimor
Ultra Champion
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...