Splunk Search

Doubt in framing search

Jananee_iNautix
Path Finder

There are different log files in different format. A log file is generated from the different log files and fed into Splunk.

For instance,
1.Success:Filename was [d8.csv]. File length was [1403]. Connected to host [feruifg.com].
2.Success:The FTP Server [rferergerg] uploaded file [113237579.csv] of length 1989 bytes from userid [NID].
3.Failure:Could not download file 201207 from [ftfew]. Reason: 550 I can only retrieve regular files.

The above information (#1 and #2) contains filename, Servername / hostname, file length but they are available in different formats as they are from different logs but combined into one log file before feeding it into Splunk.

Which would be an efficient way to extract the information from the log statements?
1. Apply different searches for different formats and combine them using append to display it in a single table?
2. Apply a common search for different formats?

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

I vote for option #1. It's simpler than trying to come up with a grand unified search for all of the different formats. Remember, someone is going to have to maintain this search so keep it simple.

---
If this reply helps you, Karma would be appreciated.
0 Karma

ankireddy007
Path Finder

It depends on the use case which you want to find from the log.

I suggest, assign different "source types" for the different formats of data at the time of indexing itself. So that field extraction will be easier, by restricting field property to the level of "Source Type".

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...