Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About divya_gn1
divya_gn1
Loves-to-Learn
Member since:
12-23-2022
07-05-2023
Community Statistics
| Posts | 5 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 12-23-2022 |
Activity Feed
- Posted Re: How to parse json related log file during index time on Getting Data In. 07-05-2023 07:12 AM
- Tagged Re: How to parse json related log file during index time on Getting Data In. 07-05-2023 07:12 AM
- Tagged Re: How to parse json related log file during index time on Getting Data In. 07-05-2023 07:12 AM
- Posted Re: How to parse json related log file during index time on Getting Data In. 07-05-2023 02:11 AM
- Tagged Re: How to parse json related log file during index time on Getting Data In. 07-05-2023 02:11 AM
- Tagged Re: How to parse json related log file during index time on Getting Data In. 07-05-2023 02:11 AM
- Posted Re: How to parse json related log file during index time on Getting Data In. 07-04-2023 08:00 AM
- Posted How to parse json related log file during index time? on Getting Data In. 07-03-2023 05:22 AM
- Posted How to pass conditional field names for a field in props.conf stanza? on Getting Data In. 12-23-2022 12:56 AM
Topics I've Started
07-05-2023
07:12 AM
This has 3 events, but whenever I am checking for the actual log file, that doesn't get divided. I can't upload complete log file. Can you try with this log, it has events which is not breaking. So. [{'id': 'e3b12550-db91-4a99-b20e-3e943fad2c7d', 'name': 'xyz', 'idn_name': '', 'idn': {}, 'tld': 'com', 'management_statxyz': 'auto_renew_enabled', 'management_type': 'transfer', 'registered_at': '2015-09-15T00:00:00Z', 'expires_at': '2024-09-15T00:00:00Z', 'updated_at': '2022-01-06T13:58:54Z', 'created_at': '2021-12-03T11:40:56Z', 'managed_at': '2021-12-21T07:55:40Z', 'premium': 'Unknown', 'key_domain': False, 'xyz': False, 'hidden_owner': False, 'local_presence': False, 'registry_lock': {'enabled': False}, 'nameservers': {'names': ['xyz03.xyz', 'xyz03.xyz', 'xyz03.xyz', 'dns4.p03.xyz', 'xyz1.xyz.com', 'xyz2.xyz.com', 'xyz3.xyz.com', 'xyz4.xyz.com'], 'labels': ['self_managed']}, 'signing_keys': [], 'registrant': {'id': 'a310c999-1b71-4a83-a6e3-f12af66a1001', 'name': 'role', 'email': 'xyz@xyz.com', 'phone': '+1.xyz', 'mobile': '', 'fax': '', 'organisation': 'xyz xyz xyz xyz', 'street1': '19 xyz xyz xyz', 'street2': '', 'street3': '', 'city': 'xyz', 'state': 'xyz', 'postcode': 'xyz', 'country_code': 'xyz'}, 'administrative': {'id': '2571a69a-07d2-442f-9142-5a418e4c0373', 'name': 'role', 'email': 'xyz@xyz.com', 'phone': '+1.xyz', 'mobile': '', 'fax': '', 'organisation': 'xyz xyz xyz xyz', 'street1': '19 xyz xyz xyz', 'street2': '', 'street3': '', 'city': 'xyz', 'state': 'xyz', 'postcode': 'xyz', 'country_code': 'xyz'}, 'technical': {'id': '311791fa-bf28-40d9-a348-d503b4fc4380', 'name': 'role', 'email': 'xyz@xyz.com', 'phone': '+1.xyz', 'mobile': '', 'fax': '', 'organisation': 'xyz xyz xyz xyz', 'street1': '19 xyz xyz xyz', 'street2': '', 'street3': '', 'city': 'xyz', 'state': 'xyz', 'postcode': 'xyz', 'country_code': 'xyz'}, 'account': {'id': 'd126c591-3ec0-4f63-afd1-5bbd923504c5', 'name': 'xyz Co (Primary)', 'contracting_company': 'xyz', 'parent': {'id': '283410a6-2785-466c-a880-51aa17c8b8b2', 'name': 'xyz Co'}}, 'active_zone': None, 'dnssec': False, 'external_comments': '', 'tags': []}, {'id': '6a735a33-a942-4f42-9a66-2bbda1466855', 'name': 'xya.com', 'idn_name': '', 'idn': {}, 'tld': 'com', 'management_statxyz': 'auto_renew_enabled', 'management_type': 'transfer', 'registered_at': '2015-09-15T00:00:00Z', 'expires_at': '2024-09-15T00:00:00Z', 'updated_at': '2022-01-06T13:58:54Z', 'created_at': '2021-12-03T11:40:56Z', 'managed_at': '2021-12-21T10:57:38Z', 'premium': 'Unknown', 'key_domain': False, 'xyz': False, 'hidden_owner': False, 'local_presence': False, 'registry_lock': {'enabled': False}, 'nameservers': {'names': ['xyz03.xyz', 'xyz03.xyz', 'xyz03.xyz', 'dns4.p03.xyz', 'xyz1.xyz.com', 'xyz2.xyz.com', 'xyz3.xyz.com', 'xyz4.xyz.com'], 'labels': ['self_managed']}, 'signing_keys': [], 'registrant': {'id': 'a310c999-1b71-4a83-a6e3-f12af66a1001', 'name': 'role', 'email': 'xyz@xyz.com', 'phone': '+1.xyz', 'mobile': '', 'fax': '', 'organisation': 'xyz xyz xyz xyz', 'street1': '19 xyz xyz xyz', 'street2': '', 'street3': '', 'city': 'xyz', 'state': 'xyz', 'postcode': 'xyz', 'country_code': 'xyz'}, 'administrative': {'id': '2571a69a-07d2-442f-9142-5a418e4c0373', 'name': 'role', 'email': 'xyz@xyz.com', 'phone': '+1.xyz', 'mobile': '', 'fax': '', 'organisation': 'xyz xyz xyz xyz', 'street1': '19 xyz xyz xyz', 'street2': '', 'street3': '', 'city': 'xyz', 'state': 'xyz', 'postcode': 'xyz', 'country_code': 'xyz'}, 'technical': {'id': '311791fa-bf28-40d9-a348-d503b4fc4380', 'name': 'role', 'email': 'xyz@xyz.com', 'phone': '+1.xyz', 'mobile': '', 'fax': '', 'organisation': 'xyz xyz xyz xyz', 'street1': '19 xyz xyz xyz', 'street2': '', 'street3': '', 'city': 'xyz', 'state': 'xyz', 'postcode': 'xyz', 'country_code': 'xyz'}, 'account': {'id': 'd126c591-3ec0-4f63-afd1-5bbd923504c5', 'name': 'xyz Co (Primary)', 'contracting_company': 'xyz', 'parent': {'id': '283410a6-2785-466c-a880-51aa17c8b8b2', 'name': 'xyz Co'}}, 'active_zone': None, 'dnssec': False, 'external_comments': '', 'tags': []}, {'id': 'a3c99348-89c4-48a6-afc5-7a487e0ee069', 'name': '5thxyzstore.com', 'idn_name': '', 'idn': {}, 'tld': 'com', 'management_statxyz': 'auto_renew_enabled', 'management_type': 'transfer', 'registered_at': '2018-07-13T00:00:00Z', 'expires_at': '2024-07-13T00:00:00Z', 'updated_at': '2023-06-13T23:16:00Z', 'created_at': '2021-12-03T11:40:57Z', 'managed_at': '2021-12-21T06:30:20Z', 'premium': 'Unknown', 'key_domain': False, 'xyz': False, 'hidden_owner': False, 'local_presence': False, 'registry_lock': {'enabled': False}, 'nameservers': {'names': ['xyz03.xyz', 'xyz03.xyz', 'xyz03.xyz', 'dns4.p03.xyz', 'xyz1.xyz.com', 'xyz2.xyz.com', 'xyz3.xyz.com', 'xyz4.xyz.com'], 'labels': ['self_managed']}, 'signing_keys': [], 'registrant': {'id': 'a310c999-1b71-4a83-a6e3-f12af66a1001', 'name': 'role', 'email': 'xyz@xyz.com', 'phone': '+1.xyz', 'mobile': '', 'fax': '', 'organisation': 'xyz xyz xyz xyz', 'street1': '19 xyz xyz xyz', 'street2': '', 'street3': '', 'city': 'xyz', 'state': 'xyz', 'postcode': 'xyz', 'country_code': 'xyz'}, 'administrative': {'id': '2571a69a-07d2-442f-9142-5a418e4c0373', 'name': 'role', 'email': 'xyz@xyz.com', 'phone': '+1.xyz', 'mobile': '', 'fax': '', 'organisation': 'xyz xyz xyz xyz', 'street1': '19 xyz xyz xyz', 'street2': '', 'street3': '', 'city': 'xyz', 'state': 'xyz', 'postcode': 'xyz', 'country_code': 'xyz'}, 'technical': {'id': '311791fa-bf28-40d9-a348-d503b4fc4380', 'name': 'role', 'email': 'xyz@xyz.com', 'phone': '+1.xyz', 'mobile': '', 'fax': '', 'organisation': 'xyz xyz xyz xyz', 'street1': '19 xyz xyz xyz', 'street2': '', 'street3': '', 'city': 'xyz', 'state': 'xyz', 'postcode': 'xyz', 'country_code': 'xyz'}, 'account': {'id': 'd126c591-3ec0-4f63-afd1-5bbd923504c5', 'name': 'xyz Co (Primary)', 'contracting_company': 'xyz', 'parent': {'id': '283410a6-2785-466c-a880-51aa17c8b8b2', 'name': 'xyz Co'}}, 'active_zone': None, 'dnssec': False, 'external_comments': '', 'tags': []}, {'id': '51654e60-a963-41ef-9844-0c0b3a30162d', 'name': 'xyz.com', 'idn_name': '', 'idn': {}, 'tld': 'com', 'management_statxyz': 'auto_renew_enabled', 'management_type': 'transfer', 'registered_at': '2002-12-11T00:00:00Z', 'expires_at': '2024-12-11T00:00:00Z', 'updated_at': '2023-04-06T04:20:55Z', 'created_at': '2023-03-29T18:56:56Z', 'managed_at': '2023-04-06T04:20:54Z', 'premium': 'Unknown', 'key_domain': False, 'xyz': False, 'hidden_owner': False, 'local_presence': False, 'registry_lock': {'enabled': False}, 'nameservers': {'names': ['xyz03.xyz', 'xyz03.xyz', 'xyz03.xyz', 'dns4.p03.xyz', 'xyz1.xyz.com', 'xyz2.xyz.com', 'xyz3.xyz.com', 'xyz4.xyz.com'], 'labels': ['self_managed']}, 'signing_keys': [], 'registrant': {'id': 'a310c999-1b71-4a83-a6e3-f12af66a1001', 'name': 'role', 'email': 'xyz@xyz.com', 'phone': '+1.xyz', 'mobile': '', 'fax': '', 'organisation': 'xyz xyz xyz xyz', 'street1': '19 xyz xyz xyz', 'street2': '', 'street3': '', 'city': 'xyz', 'state': 'xyz', 'postcode': 'xyz', 'country_code': 'xyz'}, 'administrative': {'id': '2571a69a-07d2-442f-9142-5a418e4c0373', 'name': 'role', 'email': 'xyz@xyz.com', 'phone': '+1.xyz', 'mobile': '', 'fax': '', 'organisation': 'xyz xyz xyz xyz', 'street1': '19 xyz xyz xyz', 'street2': '', 'street3': '', 'city': 'xyz', 'state': 'xyz', 'postcode': 'xyz', 'country_code': 'xyz'}, 'technical': {'id': '311791fa-bf28-40d9-a348-d503b4fc4380', 'name': 'role', 'email': 'xyz@xyz.com', 'phone': '+1.xyz', 'mobile': '', 'fax': '', 'organisation': 'xyz xyz xyz xyz', 'street1': '19 xyz xyz xyz', 'street2': '', 'street3': '', 'city': 'xyz', 'state': 'xyz', 'postcode': 'xyz', 'country_code': 'xyz'}, 'account': {'id': 'd126c591-3ec0-4f63-afd1-5bbd923504c5', 'name': 'xyz Co (Primary)', 'contracting_company': 'xyz', 'parent': {'id': '283410a6-2785-466c-a880-51aa17c8b8b2', 'name': 'xyz Co'}}, 'active_zone': None, 'dnssec': False, 'external_comments': '', 'tags': []}]
... View more
07-05-2023
02:11 AM
@richgalloway , thanks. Here is the data that gets generated from script. Whatever id that comes after tags, should be coming as next event. I could not paste the complete log file, a sample is written. [{'id': 'e3b12550-db91-4a99-b20e-3e943fad2c7d', 'name': 'xyz', 'idn_name': '', 'idn': {}, 'tld': 'com', 'management_statxyz': 'auto_renew_enabled', 'management_type': 'transfer', 'registered_at': '2015-09-15T00:00:00Z', 'expires_at': '2024-09-15T00:00:00Z', 'updated_at': '2022-01-06T13:58:54Z', 'created_at': '2021-12-03T11:40:56Z', 'managed_at': '2021-12-21T07:55:40Z', 'premium': 'Unknown', 'key_domain': False, 'xyz': False, 'hidden_owner': False, 'local_presence': False, 'registry_lock': {'enabled': False}, 'nameservers': {'names': ['xyz03.xyz', 'xyz03.xyz', 'xyz03.xyz', 'dns4.p03.xyz', 'xyz1.xyz.com', 'xyz2.xyz.com', 'xyz3.xyz.com', 'xyz4.xyz.com'], 'labels': ['self_managed']}, 'signing_keys': [], 'registrant': {'id': 'a310c999-1b71-4a83-a6e3-f12af66a1001', 'name': 'role', 'email': 'xyz@xyz.com', 'phone': '+1.xyz', 'mobile': '', 'fax': '', 'organisation': 'xyz xyz xyz xyz', 'street1': '19 xyz xyz xyz', 'street2': '', 'street3': '', 'city': 'xyz', 'state': 'xyz', 'postcode': 'xyz', 'country_code': 'xyz'}, 'administrative': {'id': '2571a69a-07d2-442f-9142-5a418e4c0373', 'name': 'role', 'email': 'xyz@xyz.com', 'phone': '+1.xyz', 'mobile': '', 'fax': '', 'organisation': 'xyz xyz xyz xyz', 'street1': '19 xyz xyz xyz', 'street2': '', 'street3': '', 'city': 'xyz', 'state': 'xyz', 'postcode': 'xyz', 'country_code': 'xyz'}, 'technical': {'id': '311791fa-bf28-40d9-a348-d503b4fc4380', 'name': 'role', 'email': 'xyz@xyz.com', 'phone': '+1.xyz', 'mobile': '', 'fax': '', 'organisation': 'xyz xyz xyz xyz', 'street1': '19 xyz xyz xyz', 'street2': '', 'street3': '', 'city': 'xyz', 'state': 'xyz', 'postcode': 'xyz', 'country_code': 'xyz'}, 'account': {'id': 'd126c591-3ec0-4f63-afd1-5bbd923504c5', 'name': 'xyz Co (Primary)', 'contracting_company': 'xyz', 'parent': {'id': '283410a6-2785-466c-a880-51aa17c8b8b2', 'name': 'xyz Co'}}, 'active_zone': None, 'dnssec': False, 'external_comments': '', 'tags': []}, {'id': '6a735a33-a942-4f42-9a66-2bbda1466855', 'name': 'xya.com', 'idn_name': '', 'idn': {}, 'tld': 'com', 'management_statxyz': 'auto_renew_enabled', 'management_type': 'transfer', 'registered_at': '2015-09-15T00:00:00Z', 'expires_at': '2024-09-15T00:00:00Z', 'updated_at': '2022-01-06T13:58:54Z', 'created_at': '2021-12-03T11:40:56Z', 'managed_at': '2021-12-21T10:57:38Z', 'premium': 'Unknown', 'key_domain': False, 'xyz': False, 'hidden_owner': False, 'local_presence': False, 'registry_lock': {'enabled': False}, 'nameservers': {'names': ['xyz03.xyz', 'xyz03.xyz', 'xyz03.xyz', 'dns4.p03.xyz', 'xyz1.xyz.com', 'xyz2.xyz.com', 'xyz3.xyz.com', 'xyz4.xyz.com'], 'labels': ['self_managed']}, 'signing_keys': [], 'registrant': {'id': 'a310c999-1b71-4a83-a6e3-f12af66a1001', 'name': 'role', 'email': 'xyz@xyz.com', 'phone': '+1.xyz', 'mobile': '', 'fax': '', 'organisation': 'xyz xyz xyz xyz', 'street1': '19 xyz xyz xyz', 'street2': '', 'street3': '', 'city': 'xyz', 'state': 'xyz', 'postcode': 'xyz', 'country_code': 'xyz'}, 'administrative': {'id': '2571a69a-07d2-442f-9142-5a418e4c0373', 'name': 'role', 'email': 'xyz@xyz.com', 'phone': '+1.xyz', 'mobile': '', 'fax': '', 'organisation': 'xyz xyz xyz xyz', 'street1': '19 xyz xyz xyz', 'street2': '', 'street3': '', 'city': 'xyz', 'state': 'xyz', 'postcode': 'xyz', 'country_code': 'xyz'}, 'technical': {'id': '311791fa-bf28-40d9-a348-d503b4fc4380', 'name': 'role', 'email': 'xyz@xyz.com', 'phone': '+1.xyz', 'mobile': '', 'fax': '', 'organisation': 'xyz xyz xyz xyz', 'street1': '19 xyz xyz xyz', 'street2': '', 'street3': '', 'city': 'xyz', 'state': 'xyz', 'postcode': 'xyz', 'country_code': 'xyz'}, 'account': {'id': 'd126c591-3ec0-4f63-afd1-5bbd923504c5', 'name': 'xyz Co (Primary)', 'contracting_company': 'xyz', 'parent': {'id': '283410a6-2785-466c-a880-51aa17c8b8b2', 'name': 'xyz Co'}}, 'active_zone': None, 'dnssec': False, 'external_comments': '', 'tags': []}, {'id': 'd1aa99ab-0548-4e85-9a17-1aec09c114a1', 'name': 'amplifysnacks.com', 'idn_name': '', 'idn': {}, 'tld': 'com', 'management_statxyz': 'auto_renew_enabled', 'management_type': 'transfer', 'registered_at': '2015-03-30T00:00:00Z', 'expires_at': '2024-02-10T00:00:00Z', 'updated_at': '2022-04-17T04:18:37Z', 'created_at': '2022-04-01T15:23:31Z', 'managed_at': '2022-04-17T04:18:36Z', 'premium': 'Unknown', 'key_domain': False, 'xyz': False, 'hidden_owner': False, 'local_presence': False, 'registry_lock': {'enabled': False}, 'nameservers': {'names': ['xyz03.xyz', 'xyz03.xyz', 'xyz03.xyz', 'dns4.p03.xyz', 'xyz1.xyz.com', 'xyz2.xyz.com', 'xyz3.xyz.com', 'xyz4.xyz.com'], 'labels': ['self_managed']}, 'signing_keys': [], 'registrant': {'id': 'a310c999-1b71-4a83-a6e3-f12af66a1001', 'name': 'role', 'email': 'xyz@xyz.com', 'phone': '+1.xyz', 'mobile': '', 'fax': '', 'organisation': 'xyz xyz xyz xyz', 'street1': '19 xyz xyz xyz', 'street2': '', 'street3': '', 'city': 'xyz', 'state': 'xyz', 'postcode': 'xyz', 'country_code': 'xyz'}, 'administrative': {'id': '2571a69a-07d2-442f-9142-5a418e4c0373', 'name': 'role', 'email': 'xyz@xyz.com', 'phone': '+1.xyz', 'mobile': '', 'fax': '', 'organisation': 'xyz xyz xyz xyz', 'street1': '19 xyz xyz xyz', 'street2': '', 'street3': '', 'city': 'xyz', 'state': 'xyz', 'postcode': 'xyz', 'country_code': 'xyz'}, 'technical': {'id': '311791fa-bf28-40d9-a348-d503b4fc4380', 'name': 'role', 'email': 'xyz@xyz.com', 'phone': '+1.xyz', 'mobile': '', 'fax': '', 'organisation': 'xyz xyz xyz xyz', 'street1': '19 xyz xyz xyz', 'street2': '', 'street3': '', 'city': 'xyz', 'state': 'xyz', 'postcode': 'xyz', 'country_code': 'xyz'}, 'account': {'id': 'd126c591-3ec0-4f63-afd1-5bbd923504c5', 'name': 'xyz Co (Primary)', 'contracting_company': 'xyz', 'parent': {'id': '283410a6-2785-466c-a880-51aa17c8b8b2', 'name': 'xyz Co'}}, 'active_zone': None, 'dnssec': False, 'external_comments': '', 'tags': []}]
... View more
07-04-2023
08:00 AM
@richgalloway , Thanks. the regex worked after a little tweak. But surprisingly, one set of data from API contains 25 entries, only 15 are ingested, 10 are ignored. These 10 are randomly selected. Not sure what might be the issue. Is it possible to identify please ? I have used below props [sourcetype_name] KV_MODE = json SHOULD_LINEMERGE = false disabled = false CHARSET = UTF-8 TRUNCATE = 0 LINE_BREAKER = \'tags\':\s\[[\w\W].*\}(,)\s\{\'id\':
... View more
07-03-2023
05:22 AM
Hi,
I need help with parsing below data that is pulled from a python script. The data is pushed to system output and script monitoring is in place to read the data. Below sample Json format data is printed to system output.
And below is the props currently present. The data has to be divided into multiple events after "tags."
[sourcetype_name]
KV_MODE = json SHOULD_LINEMERGE = false disabled = false CHARSET = UTF-8 TRUNCATE = 0 LINE_BREAKER = \"tags\":\[[\w\W].*\}\,\{\"id\": SEDCMD-remove_trailing_comma = s/\},\s/}/g
Sample data.
[{'id': 'e3b12550-db91-4a99-b20e-3e943fad2c7d', 'name': 'name', 'idn_name': '', 'idn': {}, 'tld': 'com', 'management_status': 'auto_renew_enabled', 'management_type': 'transfer', 'registered_at': '2015-09-15T00:00:00Z', 'expires_at': '2024-09-15T00:00:00Z', 'updated_at': '2022-01-06T13:58:54Z', 'created_at': '2021-12-03T11:40:56Z', 'managed_at': '2021-12-21T07:55:40Z', 'premium': 'Unknown', 'key_domain': False, 'whois_privacy': False, 'hidden_owner': False, 'local_presence': False, 'registry_lock': {'enabled': False}, 'nameservers': {'names': ['domain_name_service1.xyz3.abc.net', 'domain_name_service2.xyz3.abc.net', 'domain_name_service3.xyz3.abc.net', 'domain_name_service4.xyz3.abc.net', 'xyz1.abc.com', 'xyz2.abc.com', 'xyz3.abc.com', 'xyz4.abc.com'], 'labels': ['self_managed']}, 'signing_keys': [], 'registrant': {'id': 'a310c999-1b71-4a83-a6e3-f12af66a1001', 'name': 'Domain Administrator', 'email': 'abc@abc.com', 'phone': '+1.number', 'mobile': '', 'fax': '', 'organisation': 'company name', 'street1': 'address', 'street2': '', 'street3': '', 'city': 'city_details', 'state': 'state', 'postcode': 'pin_code', 'country_code': 'US'}, 'administrative': {'id': '2571a69a-07d2-442f-9142-5a418e4c0373', 'name': 'Domain Administrator', 'email': 'email', 'phone': '+1.number', 'mobile': '', 'fax': '', 'organisation': 'city_details Chocolate & Confectionery LLC', 'street1': '19 East Chocolate Avenue', 'street2': '', 'street3': '', 'city': 'city_details', 'state': 'state', 'postcode': 'pin_code', 'country_code': 'US'}, 'technical': {'id': '311791fa-bf28-40d9-a348-d503b4fc4380', 'name': 'Technical Manager', 'email': 'webops@city_detailss.com', 'phone': '+1.number', 'mobile': '', 'fax': '', 'organisation': 'company name', 'street1': 'address '', 'street3': '', 'city': 'city_details', 'state': 'state', 'postcode': 'pin_code', 'country_code': 'US'}, 'account': {'id': 'd126c591-3ec0-4f63-afd1-5bbd923504c5', 'name': 'city_details Co (Primary)', 'contracting_company': 'consonum', 'parent': {'id': '283410a6-2785-466c-a880-51aa17c8b8b2', 'name': 'city_details Co'}}, 'active_zone': None, 'domain_name_servicesec': False, 'external_comments': '', 'tags': []}, {'id': '6a735a33-a942-4f42-9a66-2bbda1466855', 'name': 'name', 'idn_name': '', 'idn': {}, 'tld': 'com', 'management_status': 'auto_renew_enabled', 'management_type': 'transfer', 'registered_at': '2015-09-15T00:00:00Z', 'expires_at': '2024-09-15T00:00:00Z', 'updated_at': '2022-01-06T13:58:54Z', 'created_at': '2021-12-03T11:40:56Z', 'managed_at': '2021-12-21T10:57:38Z', 'premium': 'Unknown', 'key_domain': False, 'whois_privacy': False, 'hidden_owner': False, 'local_presence': False, 'registry_lock': {'enabled': False}, 'nameservers': {'names': ['domain_name_service1.xyz3.abc.net', 'domain_name_service2.xyz3.abc.net', 'domain_name_service3.xyz3.abc.net', 'domain_name_service4.xyz3.abc.net', 'xyz1.abc.com', 'xyz2.abc.com', 'xyz3.abc.com', .... this continues till the end of the log file}]
The highlighted portion is where next ID starts. that shud be next event, but in Splunk everything is coming as a single event. Please help.
Thanks in advance.
... View more
Labels
- Labels:
-
JSON
12-23-2022
12:56 AM
There is a threat log with 2 sub_types (url and vulnerability) and sample data are as below. panwlogs-,2022-12-15T08:42:04.000000Z,no-serial,THREAT,url,10.0,2022-12-15T08:41:45.000000Z,x.x.x.x,x,x,user,,ssl,vsys1,x,untrust,tunnel.101,ethernet1/1,x,560330,1,60906,8292,55427,8292,protocol,action,7317,713,6604,15,2022-12-15T08:39:46.000000Z,0,any,4912899,src_location,US,6,9,decrypt-cert-validation,65541,65542,65550,0,,x,from-policy,,,0,,0,1970-01-01T00:00:00.000000Z,N/A,0,0,0,0,x,0,0,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2022-12-15T08:41:46.419000Z,, panwlogs-,2022-12-14T14:06:10.000000Z,no-serial,THREAT,vulnerability,10.0,2022-12-14T14:06:05.000000Z,src_ip,dest_ip,nat_src_ip,dest_ip,rule,src_user,,echo,vsys1,usodev,untrust,tunnel.102,ethernet1/1,log_forwarding,230581,6,45060,7,34147,7,protocol,action,,threat_id,Informational,client to server,174106,1src_location,dest_location,0,,,0,,,,,0,65541,65542,65550,0,,usodev,,,0,,0,1970-01-01T00:00:00.000000Z,N/A,protocol-anomaly,session_id,0x2,00000000-0000-0000-2300-000000000000,0,,,,,,,,,,,,,,,,,,,,,,,,,,,,,0,2022-12-14T14:06:05.521000Z, Both events have different set of fields. If the sub_type is url, one set of field extraction should happen, if the sub_type is vulnerability, second set of field extraction should happen. The requirement is to combine both the sub_types under same sourcetype "threat". Is it possible to do so ? props.conf [threat] SHOULD_LINEMERGE = false LINE_BREAKER = ([\r\n]+) EXTRACT-log_st=(?:THREAT,)(?<sub_type>.*?), EVAL-extract_threat=case(sub_type="url", "extract_url", sub_type="vulnerability" ,"extract_vulnerability") REPORT-search = "Is it possible to pass extract_url or extract_vulnerability based on the event ?" transforms.conf [extract_url] DELIMS = "," FIELDS = URL_field1,url_field2... [extract_vulnerability] DELIMS = "," FIELDS = vul_field1,vul_field2....
... View more
Labels
- Labels:
-
props.conf
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-05-2023
07:55 AM
|
