Splunk Search

Join multiple lines using free text

sarithbabu
Engager

I was trying to join multiple lines generated in /var/log/secure. I tried with transaction but looks like that doesn't work in this case. Below is the example of secure file. 

In this case, I want to combine all these lines based on a common text "sshd[288792]". Your help on this would be really appreciated. I cannot search with same keyword as id in this sshd "288792" will be different for each sessions. 

Jan 25 18:34:06 SERVER1 sshd[288792]: Connection from xxx.xxxx.xxx.xxx port xxxx on xxx.xxx.xxx.xxx port xx
Jan 25 18:34:10 SERVER1 sshd[288792]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=
Jan 25 18:34:10 SERVER1 sshd[288792]: pam_sss(sshd:auth): User info message: Your password will expire
Jan 25 18:34:10 SERVER1 sshd[288792]: pam_sss(sshd:auth):  success; logname= uid=0 euid=0
Jan 25 18:34:10 SERVER1 sshd[288792]: Accepted  for xxxx from xxx.xxx.xxx.xxx port xxxxx xxx
Jan 25 18:34:10 SERVER1 sshd[288792]: pam_unix(sshd:session): session opened for user xxxxx by (uid=0)
Jan 25 18:34:10 SERVER1 sshd[288792]: User child is on pid 289788

 

 

Labels (2)
0 Karma
1 Solution

morethanyell
Builder

Untested but this should solve your issue

..base search here...
| rex "sshd\[(?<sshd_pid>\d+)\]"
| eval sshd_pid = host . " - " . sshd_pid
| transaction sshd_pid

View solution in original post

morethanyell
Builder

Untested but this should solve your issue

..base search here...
| rex "sshd\[(?<sshd_pid>\d+)\]"
| eval sshd_pid = host . " - " . sshd_pid
| transaction sshd_pid

sarithbabu
Engager

Wow... This code worked.

 

 

Thank you so much.

 

 

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...