Splunk Search

How to extract different sourcetypes from the same file

splunkuzleuven
Loves-to-Learn Lots

I'm wondering if/how I can do the following:

I have a JSON structured file that is being parsed perfectly as JSON, so I get all my fields.
However, there is a certain field, let's call it "message" that is a standard web Access log.

So currently, I'm reading the log file and parse it as a json, and that works perfectly, except that the value of "message" is just a textblob of course. How can I parse the "message" part as well, so that all fields are being extraced at indextime?
Can I somehow combine sourcetypes?

I want to have all fields related to the same event though so that searching is easier.

Is this possible? Or will I need to JSON my "message" part as well before writing it to a log file?

0 Karma
1 Solution

martynoconnor
Communicator

You can't parse part of an event as one sourcetype and another part as a different sourcetype. If it's necessary to read it as that particular sourcetype you should split the content off before it reaches Splunk and read it in separately under a different sourcetype. If that's not an option you could (though I really don't recommend it) extend the JSON sourcetype definition to include additional field extractions in props.conf

View solution in original post

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@splunkuzleuven - If you already have control over writing log file then I would suggest that you write message part as JSON only. As doing props and transforms will be a performance downside in this case as it will require to go through the _raw event with regex.

0 Karma

martynoconnor
Communicator

You can't parse part of an event as one sourcetype and another part as a different sourcetype. If it's necessary to read it as that particular sourcetype you should split the content off before it reaches Splunk and read it in separately under a different sourcetype. If that's not an option you could (though I really don't recommend it) extend the JSON sourcetype definition to include additional field extractions in props.conf

0 Karma

splunkuzleuven
Loves-to-Learn Lots

Okay, it's what I was afraid of already. Thanks for the feedback.

0 Karma
Get Updates on the Splunk Community!

Splunk Lantern | Getting Started with Edge Processor, Machine Learning Toolkit ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...