Quite new to Splunk and look for some ideas how to work with this log file format from Entrust IdentityGuard radius.
One event is made up of multiple lines. It’s not always a fixed number of lines and different event type codes can produce a different number of lines.
The events always start with a timestamp and I'm trying to pull out attributes from the event such as the code type (e.g. request, accept, etc) and the username (in this example useruser12, user12).
Any help would be appreciated.
Sun Mar 24 12:05:53 AEDT 2019: Message from VPN /192.168.10.4:27766 (thread=WorkerThread-2)
data =
code = 1 (request)
id = 121
length = 56
authenticator =
attributes =
attr type = 4
attr length = 6
attr value =
attr type = 1 (user-name)
attr length = 12
attr value = useruser12 (736276F7123565744532)
attr type = 2 (user-password)
attr length = 18
attr value =
Sun Mar 24 12:05:53 AEDT 2019: Message to VPN /192.168.10.45:27766 (thread=WorkerThread-2)
data =
code = 2 (accept)
id = 121
length = 38
authenticator =
attributes =
attr type = 80 (message-authenticator)
attr length = 18
attr value =
Sun Mar 24 12:20:54 AEDT 2019: Message from VPN /192.168.10.76:14004 (thread=WorkerThread-2)
data =
code = 1 (request)
id = 4
length = 52
authenticator =
attributes =
attr type = 4
attr length = 6
attr value =
attr type = 1 (user-name)
attr length = 8
attr value = user12 (697A6C7F6C7A)
attr type = 2 (user-password)
attr length = 18
attr value =
