About pchintha

youngsuh · ‎10-28-2022

@mayurr98 Here is my search that I want to put into props & transform. index=nsips_horizon sourcetype="vmware:uag:esmanager" | rex "^(?:[^ \n]* ){3}(?P<UAG_hostname>[a-z]+\d+)\s+(?P<app_name>[^:]+)[^:\n]*:\s+\[(?P<thread_id>\S+?)\](?P<log_level>[^ ]+)\s+(?P<file_name>[^\[]+)\[(?P<function_name>[^:]+):\s+(?P<line_num>[^\]]+)[^\[\n]*\[(?P<client_IP>[^\]]+|.?)\]\[(?P<username>.+|.?)\]\[(?P<session_type>.+|.?)\]\[(?P<session_id>[^\]]+)[^\]\n]*\]\s+\-\s+(?P<message>.+)" here is sample log: Sep 9 05:36:55 UAG Name UAG-ESMANAGER: [Curator-QueueBuilder-0]INFO utils.SyslogManager[start: 355][][][][] - Edge Service Manager : started Sep 9 05:36:54 UAG Name UAG-ESMANAGER: [Curator-QueueBuilder-0]INFO utils.SyslogManager[stop: 1071][][][][] - Edge Service Manager : stopped based on what I read the props.conf [vmware:uag:esmanager] REPORT-esmanager = esmanager Transform.conf [esmanager] REGEX = ^(?:[^ \n]* ){3}(?P<UAG_hostname>[a-z]+\d+)\s+(?P<app_name>[^:]+)[^:\n]*:\s+\[(?P<thread_id>\S+?)\](?P<log_level>[^ ]+)\s+(?P<file_name>[^\[]+)\[(?P<function_name>[^:]+):\s+(?P<line_num>[^\]]+)[^\[\n]*\[(?P<client_IP>[^\]]+|.?)\]\[(?P<username>.+|.?)\]\[(?P<session_type>.+|.?)\]\[(?P<session_id>[^\]]+)[^\]\n]*\]\s+\-\s+(?P<message>.+) FORMAT = $1::$2 Right? What's $1::$2 doing?

diogofgm · ‎03-24-2022

there errors you are getting there its because in regex101 you need to escape the "/" like "\/"

pchintha · ‎02-14-2022

This helps for me, from in this and expires is in GMT and the expTime is in EST guess so and we need all to know in EST only

richgalloway · ‎12-28-2021

Please clarify which part of each event is the Event_Name, especially Example 2. Are the sample events from the same sourcetype? They look very different, which means they can have different field extractions.

kvnpichon · ‎11-15-2021

Hi, If you search logs from the SH, the field "host" (Splunk default field) is the source host from which the event originated. Hope it helps

pchintha · ‎11-14-2021

HI, I am having some logs comes with XML format for Privilaged Access Manager, i need to extract the fields by default like this Example: fields <level></level> <k>=<v> commandinitiatio =USER <success>false</success> success=false jan 9 09:04:56 1.30.124.24 1 2012-01-09T14:04:56+00:00 yahoota.com pam - metric DETAIL <Metric><type>getAccount</type><level>1</level><description><hashmap><k>commandInitiator</k><v>USER</v><k>commandName</k><v>getAccount</v><k>clientType</k><v>java</v><k>osarch</k><v>amd64</v><k>targetServerAlias</k><v>USR_LOCL_MARKETING_INTELLIGENCE_BATCH</v><k>nodeid</k><v><?xml version="1.0" encoding="utf-8" ?><nodeid><macaddr></macaddr><macaddr&gt:E0</macaddr><macaddr>A0:C:E0</macaddr><macaddr>:E0</macaddr><macaddr>1:E1</macaddr><macaddr>1:E3</macaddr><macaddr>:E2</macaddr><machineid>1E3</machineid><applicationtype>cspm</applicationtype></nodeid></v><k>enablefips</k><v>true</v><k>executionUID</k><v>bibatusr</v><k>version</k><v>4.5.3</v><k>scriptStat</k><v>/opt/ibm/bigintegrate/tools</v><k>scriptName</k><v>/home/infra/bibatusr/run_ds_job.sh</v><k>osversion</k><v>3.10.0-1127.el7.x86_64</v><k>digestLoginDate</k><k>applicationtype</k><v>cspm</v><k>getXMLIndicator</k><v>false</v></hashmap></description><errorCode>405</errorCode><userID>client</userID><success>false</success><originatingIPAddress>10.111.211.50</originatingIPAddress><originatingHostName>yahoota.com</originatingHostName><extensionType></extensionType></Metric> I need this as default when these type logs integrated to splunk its automatically extract fields when we set up in props.conf and trasforms.conf so here what is the stanzas we have to write under this.

pchintha · ‎11-01-2021

Hello Team, In my org they installed the below certs in particular role, need to know by seeing below table which category it may comes to. Can anyone please explain how this. We are checking this link but not understand. About securing Splunk Enterprise with SSL - Splunk Documentation Role Cert Remarks Internal Heavy Forwarders /opt/splunk/etc/auth/myServerCertificate.pem /opt/splunk/etc/auth/rootCA.pem SH cluster Cluster Master DMZ HF DS ES SH Deployer HF Cluster IDX Cluster Monitoring Console ES SH Cluster /opt/splunk/etc/auth/webcerts/mySplunkWebCertificate.pem /opt/splunk/etc/auth/myServerCertificate.pem /opt/splunk/etc/auth/rootCA.pem

Posts	22
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎10-31-2021

Online Status	Offline
Date Last Visited	‎04-12-2022 09:39 PM

How to Extract Fields from raw events with regex

How to create regex to extract the fields

SSL certificate checker issue: How to see all SSL ...

Regex Extraction for Field

XML Field Extractions

stanza's for props.conf

Custom SSL Cert exchange confirmation

Re: Fields Extraction from raw events with regex

Re: How to create regex to extract the fields

Re: SSL certificate checker issue

Re: Regex Extraction for Field

Re: stanza's for props.conf

XML Field Extractions

Custom SSL Cert exchange confirmation