Dears, I have an app which generates logs in following pattern: ---------------------------------------- Timestamp: 2019-08-23 14:00:01.545 UserLogin: ascache UserId: -1 Severity: Information Message: REQUEST ---------------------------------------- ---------------------------------------- Timestamp: 2019-08-23 14:00:02.949 UserLogin: Gistt UserId: -1 Severity: Information Message: REQUEST ---------------------------------------- ---------------------------------------- Timestamp: 2019-08-23 14:00:24.634 UserLogin: rerwer UserId: 3254 Severity: Information Message: xxxx ---------------------------------------- Every event is encapsulated betwen ---------------------------------------- characters. I'm trying to have Splunk break this accordingly, but I'm failing. I've tried the following stanzas (commented out are ones that failed, uncommented also fail...): # [APP-Trace.log] # LINE_BREAKER = \-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\- # # [APP-PerformanceLogs.log] # LINE_BREAKER = \-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\- # # 13:51 2019-08-29 # [APP-Trace.log] # LINE_BREAKER = \-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\s+\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\- # [APP-PerformanceLogs.log] # LINE_BREAKER = \-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\s+\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\- [APP-Trace.log] LINE_BREAKER = \-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\- SHOULD_LINEMERGE = false [APP-PerformanceLogs.log] LINE_BREAKER = \-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\- SHOULD_LINEMERGE = false Can you please assist how to properly capture this? Thank you, ... View more

Hello Splunkers! For some time I'm trying to figure out how to feed results of a DNS blacklist check versus DHCP logs with respect to the time of event in DNS log and it's counterpart DHCP log. Let's say I run the following query to get results of my DNS Blacklist hits: index="msad" sourcetype="msad:nt6:dns" questionname="BLACKLISTED_DOMAINS" source_ip!="8.8.8.8" | table _time source_ip | dedup source_ip This gives me a nice table showing the host (by IP) attempting access to blacklisted domain and most recent time that it happened. Now I wish to use the resulting table as input into a search (DHCP or any other log that can correlate IP to Hostname with Time) that will resolve/correlate the resulting IPs with hostnames at the time of the resulting event. I can't figure this out. I've tried running a subsearch but to my understanding it accepts only single values as input (thus I can feed it IPs, but I loose the time and the results might indicate different host in a dynamic DHCP enviroment for past events). Is this possible? How? 🙂 ... View more