Splunk Search

Entrust IdentityGuard radius logs

apask
New Member

Quite new to Splunk and look for some ideas how to work with this log file format from Entrust IdentityGuard radius.
One event is made up of multiple lines. It’s not always a fixed number of lines and different event type codes can produce a different number of lines.

The events always start with a timestamp and I'm trying to pull out attributes from the event such as the code type (e.g. request, accept, etc) and the username (in this example useruser12, user12).

Any help would be appreciated.

Sun Mar 24 12:05:53 AEDT 2019: Message from VPN /192.168.10.4:27766 (thread=WorkerThread-2)
data =          
code =          1 (request)
id =            121
length =        56
authenticator = 
attributes =    
attr type =     4 
attr length =   6
attr value =    
attr type =     1 (user-name)
attr length =   12
attr value =    useruser12 (736276F7123565744532)
attr type =     2 (user-password)
attr length =   18
attr value =    
Sun Mar 24 12:05:53 AEDT 2019: Message to VPN /192.168.10.45:27766 (thread=WorkerThread-2)
data =          
code =          2 (accept)
id =            121
length =        38
authenticator = 
attributes =    
attr type =     80 (message-authenticator)
attr length =   18
attr value =    
Sun Mar 24 12:20:54 AEDT 2019: Message from VPN /192.168.10.76:14004 (thread=WorkerThread-2)
data =          
code =          1 (request)
id =            4
length =        52
authenticator = 
attributes =    
attr type =     4 
attr length =   6
attr value =    
attr type =     1 (user-name)
attr length =   8
attr value =    user12 (697A6C7F6C7A)
attr type =     2 (user-password)
attr length =   18
attr value =    
0 Karma
Get Updates on the Splunk Community!

Monitoring MariaDB and MySQL

In a previous post, we explored monitoring PostgreSQL and general best practices around which metrics to ...

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...