How to extract the timestamp and other fields from my sample event?

[kiran331]

HI

I need to extract the fields from the raw Cisco umbrella logs. Is there any add-on for this one or do I have to extract the fields manually?

"2015-01-16 17:48:41","ActiveDirectoryUserName","ActiveDirectoryUserName,ADSite,Network","10.10.1.100","24.123.132.133","Allowed","1 (A)","NOERROR","domain-visited.com.","Social Networking"

How to extract the fields:

ActiveDirectoryUserName as user

ADSite
Network
Allowed as action
domain-visited.com. as URL
Social Networking as category

[mikaelbje]

Or just use this add-on which already does this for you and is CIM compliant: https://github.com/inspired/TA-OpenDNS

See the readme file for instructions on setting up your inputs using the Splunk AWS Add-on. Set the sourcetype to opendns:dnslog

[woodcock]

Like this:

... | rex "^(?:\"[^\",]+\",)\"(?<user>[^\",]+)\",\"(?<user2>[^\",]+),(?<ADSite>[^\",]+),(?<Network>[^\",]+)\",(?:\"[^\",]+\",){2}\"(?<action>[^\",]+)\",(?:\"[^\",]+\",){2}\"(?<URL>[^\",]+)\",\"(?<category>[^\",]+)\""

[kiran331]

Thanks woodcock,

How to add this in props.conf