Splunk Search

dlink log extraction

javier_reina
Explorer

Hello,

we are trying to parse logs from a dlink DXS-3600 but we are not able to find the correct format, we have tried with several versions of syslog but it does not work.

Does anyone know what format these logs are in?

Oct 15 15:36:04 10.68.16.16 Oct 15 13:36:04 10.68.16.16 INFO: Successful login through Web (Username: Gestion, IP: 10.168.0.53)
Oct 15 15:41:45 10.68.16.16 Oct 15 13:41:44 10.68.16.16 INFO: Unit 1, Configuration uploaded by WEB successfully. (Username: Gestion, IP: 10.168.0.53, MAC: 00-00-00-00-00-00, Server IP: 10.168.0.53, File Name: running-config.cfg)
Oct 15 15:42:13 10.68.16.16 Oct 15 13:42:14 10.68.16.16 INFO: Unit 1, Configuration uploaded by WEB successfully. (Username: Gestion, IP: 10.168.0.53, MAC: 00-00-00-00-00-00, Server IP: 10.168.0.53, File Name: running-config.cfg)
Oct 15 15:42:33 10.68.16.16 Oct 15 13:42:34 10.68.16.16 INFO: Unit 1, Configuration uploaded by WEB successfully. (Username: Gestion, IP: 10.168.0.53, MAC: 00-00-00-00-00-00, Server IP: 10.168.0.53, File Name: startup-config.cfg)
Oct 15 15:42:44 10.68.16.16 Oct 15 13:42:44 10.68.16.16 INFO: Unit 1, Configuration uploaded by WEB successfully. (Username: Gestion, IP: 10.168.0.53, MAC: 00-00-00-00-00-00, Server IP: 10.168.0.53, File Name: startup-config.cfg)

 

Greetings

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

If you can't find an existing format that works then just create your own.  It's not that hard.  Start by putting this in your props.conf file.

[dlink]
LINE_BREAKER = ([\r\n]+)
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
TIME_FORMAT = %b %d %H:%M:%S
TIME_PREFIX = ^
MAX_TIMESTAMP_LOOKAHEAD = 15
TZ = UTC
EXTRACT-loglevel = \d\d\.\d\d\s(?<log_level>\w+):
EXTRACT-username = Username:\s(?<username>\w+)

Adjust the value of the TZ setting to match the time zone of the source.  Add more EXTRACT lines to pull more fields.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...