Splunk Search

How to parse an Aide scan log file to display each line?

bcain22
Engager

I am new to Splunk and I am trying to parse an Aide scan log file to display each line. Currently, Splunk just reads all the lines as a single event.  I know I may have to build a regex once I have Splunk reading the file correctly, but currently Splunk isn't extracting the events by the newline character. Sample data below:

bcain22_2-1647895680328.png

 

bcain22_1-1647895288925.png

 

How can I get Splunk to parse each line vs reading the entire file as a single event?

bcain22_0-1647895236764.png

 

 

Labels (1)
0 Karma
1 Solution

bcain22
Engager
0 Karma
Get Updates on the Splunk Community!

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...

Adoption of Infrastructure Monitoring at Splunk

  Splunk's Growth Engineering team showcases one of their first Splunk product adoption-Splunk Infrastructure ...

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...