Evaluation Noob Question - Help Needed

[jrialto]

We have a large number of audit files from Oracle that have been written to the Local OS. In the audit files there is a record of user ID's. However, these are used by large numbers of different users (up to 1800), and one file per login.

During the data import, Splunk imported USERID as a searchable field, but not the trailing data in square brackets or username in quotes. Is there a way to leverage Splunk functionality and expand the searchable data and return an amalgamated report which shows one entry for each USERID over the specified time period. The end result should be one entry for each user that logged in over the last 90 days.

Each user will have a different userid and name, but their relationship is constant.

For example.

USERID:[5] "JSMITH"

USERID:[6] "HJONES"

USERID:[7] "BCURRY"

USERID:[8] "TDAVIS"

Any help would be truly appreciated and success will be used to build a business case!

Thanks

[jrialto]

Tried this in the props.conf located in $SPLUNK_HOME/etc/system/local, but it did not work.

Can someone sense check this PLEASE!!!

#### FILE MATCH CONDITIONS

[source::///root/.../*.aud]
sourcetype = oracle_aud_logs

#### FIELD EXTRACTION

[oracle_aud_logs]
EXTRACT-user = USERID:(?[[0-9]+] "[^"]+")

[twinspop]

Move the EXTRACT line up to the source stanza.

Also, verify the source stanza is doing what you think it's doing. Search for sourcetype=oracle_aud_logs to make sure that stanza is working.

[twinspop]

In props.conf (either $SPLUNK_HOME/etc/system/local, or the local directory of the app you're using for the search):

[sourcetype_of_your_audit_logs]
EXTRACT-user = USERID:(?<USERID>\[[0-9]+\] "[^"]+")

See Splunk Props.conf Docs for more information.
HTH,
jon