Splunk Search

Help me write props.conf /transforms.conf for below data.

muizash
Path Finder

36,03/26/20,13:12:04,Packet dropped because of Client ID hash mismatch or standby server.,IP,,B88584ADE973,,0,6,,,,,,,,,0
36,03/26/20,13:12:04,Packet dropped because of Client ID hash mismatch or standby server.,IP,,B88584ADE973,,0,6,,,,,,,,,0
11,03/26/20,13:12:04,Renew,IP,Oscarphone8,B841A4B2E9C8,,2541188417,0,,,,,,,,,0
11,03/26/20,13:12:04,Renew,IP,Oscarphone8,B841A4B2E9C8,,2541188417,0,,,,,,,,,0
31,03/26/20,13:12:04,DNS Update Failed,IP,xxx.jp,,,0,6,,,,,,,,,2
30,03/26/20,13:12:04,DNS Update Request,IP,xxx.jp,,,0,6,,,,,,,,,0
11,03/26/20,13:12:04,Renew,IP,xxx.jp,105BADA1EB91,,999576276,0,,,,0x4D53465420352E30,MSFT 5.0,,,,0
31,03/26/20,13:12:04,DNS Update Failed,IP,xxx.jp,,,0,6,,,,,,,,,2
30,03/26/20,13:12:04,DNS Update Request,IP,xxx.jp,,,0,6,,,,,,,,,0

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Start with these settings.

[mysourcetype]
TIME_PREFIX = ,
TIME_FORMAT = %m/%d/%y, %H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD = 18
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)
TRUNCATE = 10000
---
If this reply helps you, Karma would be appreciated.
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...