best practice for custom syslog field extraction

[Skins]

I have a syslog file and none of the default sourcetypes give me what i want - so i have:

any advice on best approach for props.conf

Apr 15 16:54:01 HOSTNAMEX Group CfgSrvc: hd[0]: cfgcore: WritePhase2(Security,system,security.authentication.accounts[0].adminaccount.failedlogincount) value update "9234" => "9235"
Apr 15 16:54:01 HOSTNAMEX Group CfgSrvc: hd[0]: cfgcore: callback DynamicValidate(Security,"807847",system,{security[0].authentication[0].accounts[0].adminaccount[0].failedlogincount[0]/local,"9235"},"PlatCfgS/5/01-0"[17])
Apr 15 16:54:01 HOSTNAMEX Group Security: hd[0]: SecurityService: login login failed, increment # of failed logins
Apr 15 16:54:01 HOSTNAMEX Group Security: hd[0]: SecurityService: login login failed, setLoginResult 6
Apr 15 16:54:01 HOSTNAMEX Group Security: hd[0]: SecurityService:  If loginSuccess is false ( 
Apr 15 16:54:01 HOSTNAMEX Group Security: hd[0]: SecurityService: LocalAuthenticator::login, role 3 loginSuccess 0
Apr 15 16:54:01 HOSTNAMEX Group Security: hd[0]: SecurityService: SecurityServiceLoginRequest(): username: admin
Apr 15 16:54:01 HOSTNAMEX Group logcat: hd[0]: UAppSvcs(2132): (legacyapi) API:OUT:Password: 
Apr 15 16:54:01 HOSTNAMEX Group logcat: hd[0]: UAppSvcs(2132): (legacyapi) API:OUT: -- password failed, retry --

gratzi

[chris_barrett]

A quick Google would suggest that the logs are coming from a Polycom system/device of some sort.

The following is completely untested but itshould be enough to make start. You didn't say what the data is currently being sourcetype as so I've catered for it coming in as "syslog" and it then being overridden to "polycom". Ideally though it would be easier if the events were sourcetyped as polycom by the monitor stanza.

If you're open to providing me with a bigger sample of logs then I'd be happy to assist with a view to developing a TA that could be released to SplunkBase for the benefit of anyone else with these systems/devices.

--- props.conf ---

[syslog]
TRANSFORMS-override_sourcetype_for_polycom = override_sourcetype_for_polycom

[polycom]
SHOULD_LINEMERGE = false
TIME_PREFIX = ^
EXTRACT-polycom_basics = \s(?<hostname>\S+?)\sGroup\s(?<unknown_01>[^:]+?):\s(?<unknown_02>[^:]+?):\s(?<unknown_03>[^:]+?):\s(?<message>.+?)$

--- transforms.conf ---

[override_sourcetype_for_polycom]
SOURCE_KEY = _raw
REGEX = \sGroup\s(CfgSrvc|Security|logcat|):\s
DEST_KEY = MetaData:Sourcetype
FORMAT = sourcetype::polycom

[kmorris_splunk]

If there isn't a Splunk Add-on for this source, you will need to teach Splunk what the fields are. This can be done via the GUI, which will update props.conf for you for that sourcetype. https://docs.splunk.com/Documentation/Splunk/7.2.5/Knowledge/FXSelectSamplestep

You could also do it by manually editing the props.conf if you are more adventurous.
https://docs.splunk.com/Documentation/Splunk/7.2.5/Knowledge/Createandmaintainsearch-timefieldextrac...

[skalliger]

Best way to go would be to get familiar with the Add-on builder.

Skalli