Splunk Search

best practice for custom syslog field extraction

Skins
Path Finder

I have a syslog file and none of the default sourcetypes give me what i want - so i have:

any advice on best approach for props.conf

Apr 15 16:54:01 HOSTNAMEX Group CfgSrvc: hd[0]: cfgcore: WritePhase2(Security,system,security.authentication.accounts[0].adminaccount.failedlogincount) value update "9234" => "9235"
Apr 15 16:54:01 HOSTNAMEX Group CfgSrvc: hd[0]: cfgcore: callback DynamicValidate(Security,"807847",system,{security[0].authentication[0].accounts[0].adminaccount[0].failedlogincount[0]/local,"9235"},"PlatCfgS/5/01-0"[17])
Apr 15 16:54:01 HOSTNAMEX Group Security: hd[0]: SecurityService: login login failed, increment # of failed logins
Apr 15 16:54:01 HOSTNAMEX Group Security: hd[0]: SecurityService: login login failed, setLoginResult 6
Apr 15 16:54:01 HOSTNAMEX Group Security: hd[0]: SecurityService:  If loginSuccess is false ( 
Apr 15 16:54:01 HOSTNAMEX Group Security: hd[0]: SecurityService: LocalAuthenticator::login, role 3 loginSuccess 0
Apr 15 16:54:01 HOSTNAMEX Group Security: hd[0]: SecurityService: SecurityServiceLoginRequest(): username: admin
Apr 15 16:54:01 HOSTNAMEX Group logcat: hd[0]: UAppSvcs(2132): (legacyapi) API:OUT:Password: 
Apr 15 16:54:01 HOSTNAMEX Group logcat: hd[0]: UAppSvcs(2132): (legacyapi) API:OUT: -- password failed, retry --

gratzi

Tags (1)
0 Karma

chris_barrett
Communicator

A quick Google would suggest that the logs are coming from a Polycom system/device of some sort.

The following is completely untested but itshould be enough to make start. You didn't say what the data is currently being sourcetype as so I've catered for it coming in as "syslog" and it then being overridden to "polycom". Ideally though it would be easier if the events were sourcetyped as polycom by the monitor stanza.

If you're open to providing me with a bigger sample of logs then I'd be happy to assist with a view to developing a TA that could be released to SplunkBase for the benefit of anyone else with these systems/devices.

--- props.conf ---

[syslog]
TRANSFORMS-override_sourcetype_for_polycom = override_sourcetype_for_polycom

[polycom]
SHOULD_LINEMERGE = false
TIME_PREFIX = ^
EXTRACT-polycom_basics = \s(?<hostname>\S+?)\sGroup\s(?<unknown_01>[^:]+?):\s(?<unknown_02>[^:]+?):\s(?<unknown_03>[^:]+?):\s(?<message>.+?)$

--- transforms.conf ---

[override_sourcetype_for_polycom]
SOURCE_KEY = _raw
REGEX = \sGroup\s(CfgSrvc|Security|logcat|):\s
DEST_KEY = MetaData:Sourcetype
FORMAT = sourcetype::polycom
0 Karma

kmorris_splunk
Splunk Employee
Splunk Employee

If there isn't a Splunk Add-on for this source, you will need to teach Splunk what the fields are. This can be done via the GUI, which will update props.conf for you for that sourcetype. https://docs.splunk.com/Documentation/Splunk/7.2.5/Knowledge/FXSelectSamplestep

You could also do it by manually editing the props.conf if you are more adventurous.
https://docs.splunk.com/Documentation/Splunk/7.2.5/Knowledge/Createandmaintainsearch-timefieldextrac...

0 Karma

skalliger
SplunkTrust
SplunkTrust

Best way to go would be to get familiar with the Add-on builder.

Skalli

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...