Splunk Search

Join multiple lines using free text

sarithbabu
Engager

I was trying to join multiple lines generated in /var/log/secure. I tried with transaction but looks like that doesn't work in this case. Below is the example of secure file. 

In this case, I want to combine all these lines based on a common text "sshd[288792]". Your help on this would be really appreciated. I cannot search with same keyword as id in this sshd "288792" will be different for each sessions. 

Jan 25 18:34:06 SERVER1 sshd[288792]: Connection from xxx.xxxx.xxx.xxx port xxxx on xxx.xxx.xxx.xxx port xx
Jan 25 18:34:10 SERVER1 sshd[288792]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=
Jan 25 18:34:10 SERVER1 sshd[288792]: pam_sss(sshd:auth): User info message: Your password will expire
Jan 25 18:34:10 SERVER1 sshd[288792]: pam_sss(sshd:auth):  success; logname= uid=0 euid=0
Jan 25 18:34:10 SERVER1 sshd[288792]: Accepted  for xxxx from xxx.xxx.xxx.xxx port xxxxx xxx
Jan 25 18:34:10 SERVER1 sshd[288792]: pam_unix(sshd:session): session opened for user xxxxx by (uid=0)
Jan 25 18:34:10 SERVER1 sshd[288792]: User child is on pid 289788

 

 

Labels (2)
0 Karma
1 Solution

morethanyell
Builder

Untested but this should solve your issue

..base search here...
| rex "sshd\[(?<sshd_pid>\d+)\]"
| eval sshd_pid = host . " - " . sshd_pid
| transaction sshd_pid

View solution in original post

morethanyell
Builder

Untested but this should solve your issue

..base search here...
| rex "sshd\[(?<sshd_pid>\d+)\]"
| eval sshd_pid = host . " - " . sshd_pid
| transaction sshd_pid

sarithbabu
Engager

Wow... This code worked.

 

 

Thank you so much.

 

 

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...