Splunk Search

Creating a Log for use with Splunk

eulalie
New Member

We have an application that does NOT generate it's own logs. We are in a position where we can get the logs generated on the fly to be able to do a report showing a timeline based on logs from 4 systems.

The applications owner can generate the logs in almost any format we want. I had him generate a log with the format:

FIELD1="VALUE1" FIELD2="VALUE2"

Where field 1 happens to be the event time and field 2 happens to be username. I added OR FIELD2=VALUE to my search and added the fields for FIELD1 and FIELD2 to my | table.

I have two problems. I assume the second is a result of the first. When I look at that file only in splunk it shows me the events and it seems to extract the fields, however when I do a search it does not. The other issue is that it doens't appear to be viewing FIELD1 as the even date and time.. it's just another field with some data in it.

The application can give me CSV or TXT files. How should I get it formatted for Splunk to know what we're going for?

Tags (1)
0 Karma

Damien_Dallimor
Ultra Champion
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...