Splunk Search

How to parse log with a lot of indicators?

anissabnk
Path Finder

Hello everyone, 

I have a question for you, and I need your help please 🙂

I have some logs, but the parsing isn't done. 

In a same log, I have a lot of indicators and I need to extract the fields :

-cpu_model

device_type:
-distinguished_name:
- entity: 
- last_boot_duration: 

- last_ip_address: 
- last_logon_duration: 

last_logon_time:

 -   last_system_boot: 
   -  mac_addresses: [

00:42:38:CA:81:72
00:42:38:CA:81:7300:42:38:CA:81:76
         02:42:38:CA:81:72
         74:78:27:91:41:BB
         B0:9F:80:55:40:44 

       ]

      - name: PCW-TOU-76566
       -number_of_days_since_last_boot:
      - number_of_days_since_last_logon: 
     -  number_of_monitors: 3
       - os_version_and_architecture: Windows 10 Pro 21H2 (64 bits)
      - platform: windows
      - score:Device performance/Boot speed: null
       -system_drive_capacity: 506333229056
     -  system_drive_usage: 0.19
      - total_nonsystem_drive_capacity: 0
       -total_nonsystem_drive_usage: null
       -total_ram: 8589934592

 

anissabnk_0-1674668405561.png

The log is like this :

anissabnk_0-1674669178508.png

What can I do to have the fields extracted to develop my indicators ? 

The regex method is not possible in this case, can I use rex command ? and how I can do for this example ? 

I need your help, thank you so much 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

This looks like JSON. Use the spath command

| spath

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

This looks like JSON. Use the spath command

| spath
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...