Splunk Search

Question about not standard source type

glm_cybaze
Engager

Hi to all, I'm new to the splunk use and I have an issue with a software that write logs in a non standard way (of my fresh knowledge of splunk)
{

"name":"clientLogger",
"level":30,
"levelName":"info",
"msg":"[audio] iceServers",
"time":"2018-08-27T19:32:57.389Z",
"src":"xxxxxx",
"v":1,
"extraInfo":{

"sessionToken":"e7boenucj1pwkbfc",
"meetingId":"183f0bf3a0982a127bdb8161e0c44eb696b3e75c-1535398242909",
"requesterUserId":"w_klfavdlkumj8",
"fullname":"Ios",
"confname":"Demo Meeting",
"externUserID":"w_klfavdlkumj8"
},
"url":"xxxx",
"userAgent":"Mozilla/5.0",
"count":1
}
and in splunk the log are:
alt text

the only info I need are:
- time
- fullname
- confname

But regex don't work and I don't recognize how to set only the proper field!
Some help or how to guide would be helpful!
Thanks in advance!

Labels (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

rex should work. You didn't say what you tried, so we can't say what you might have done wrong. Try this:

index=foo
| rex "time\":\"(?<time>[^\"]+)"
| rex "fullname\":\"(?<fullname>[^\"]+)"
| rex "confname\":\"(?<confname>[^\"]+)"
| table time, fullname, confname
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

to4kawa
SplunkTrust
SplunkTrust

make props.conf

SEDCMD-trim = s/.*?\]//g
TRUNCATE = 0
INDEXED_EXTRACTION = none
KV_MODE = json
SHOULD_LINEMERGE = false

You can see the fields {}.time , extraInfo{}.fullname and extraInfo{}.confname

0 Karma

glm_cybaze
Engager

Will try this solution too!
Thanks

0 Karma

richgalloway
SplunkTrust
SplunkTrust

rex should work. You didn't say what you tried, so we can't say what you might have done wrong. Try this:

index=foo
| rex "time\":\"(?<time>[^\"]+)"
| rex "fullname\":\"(?<fullname>[^\"]+)"
| rex "confname\":\"(?<confname>[^\"]+)"
| table time, fullname, confname
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

glm_cybaze
Engager

Thanks, i used in search and work! created report and dashboard! now i try to replicate and add more complex analisys!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If your problem is resolved then please accept an answer to help future readers.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!