Splunk Search

dlink log extraction

javier_reina
Explorer

Hello,

we are trying to parse logs from a dlink DXS-3600 but we are not able to find the correct format, we have tried with several versions of syslog but it does not work.

Does anyone know what format these logs are in?

Oct 15 15:36:04 10.68.16.16 Oct 15 13:36:04 10.68.16.16 INFO: Successful login through Web (Username: Gestion, IP: 10.168.0.53)
Oct 15 15:41:45 10.68.16.16 Oct 15 13:41:44 10.68.16.16 INFO: Unit 1, Configuration uploaded by WEB successfully. (Username: Gestion, IP: 10.168.0.53, MAC: 00-00-00-00-00-00, Server IP: 10.168.0.53, File Name: running-config.cfg)
Oct 15 15:42:13 10.68.16.16 Oct 15 13:42:14 10.68.16.16 INFO: Unit 1, Configuration uploaded by WEB successfully. (Username: Gestion, IP: 10.168.0.53, MAC: 00-00-00-00-00-00, Server IP: 10.168.0.53, File Name: running-config.cfg)
Oct 15 15:42:33 10.68.16.16 Oct 15 13:42:34 10.68.16.16 INFO: Unit 1, Configuration uploaded by WEB successfully. (Username: Gestion, IP: 10.168.0.53, MAC: 00-00-00-00-00-00, Server IP: 10.168.0.53, File Name: startup-config.cfg)
Oct 15 15:42:44 10.68.16.16 Oct 15 13:42:44 10.68.16.16 INFO: Unit 1, Configuration uploaded by WEB successfully. (Username: Gestion, IP: 10.168.0.53, MAC: 00-00-00-00-00-00, Server IP: 10.168.0.53, File Name: startup-config.cfg)

 

Greetings

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

If you can't find an existing format that works then just create your own.  It's not that hard.  Start by putting this in your props.conf file.

[dlink]
LINE_BREAKER = ([\r\n]+)
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
TIME_FORMAT = %b %d %H:%M:%S
TIME_PREFIX = ^
MAX_TIMESTAMP_LOOKAHEAD = 15
TZ = UTC
EXTRACT-loglevel = \d\d\.\d\d\s(?<log_level>\w+):
EXTRACT-username = Username:\s(?<username>\w+)

Adjust the value of the TZ setting to match the time zone of the source.  Add more EXTRACT lines to pull more fields.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...