Getting Data In

How to configure SEDCMD in props.conf?

jpena323
Explorer

Hi guys,

I am having a really hard time figuring out how to get the sedcmd to work in props.conf. I'd appreciate any help you can lend. Here is an example of my config:

PROPS.CONF

[source::.../syslog_logs/*srx*/user.info.log]
SEDCMD-removeunwanted1 = s/\s(src-nat-rule-name=\"[^\"]+\")//
SEDCMD-removeunwanted2 = s/\s(source-zone-name=\"[^\"]+\")//
SEDCMD-removeunwanted3 = s/\s(destination-zone-name=\"[^\"]+\")//
SEDCMD-alter1 = s/destination/dst/g
SEDCMD-alter2 = s/source/src/g
SEDCMD-alter3 = s/address/ip/g
SEDCMD-alter4 = 's/protocol-id="17"/UDP/'
SEDCMD-alter5 = 's/protocol-id="6"/TCP/'
SEDCMD-alter6 = 's/protocol-id="1"/ICMP/

The point of this is to simplify our logs from Juniper SRXs. When I do a "--debug props list | grep SEDCMD", I see the commands listed. Not sure what I'm doing incorrectly, but have a couple of questions in addition to any advice you guys have.

1.) Does this props.conf have to be configured on the forwarder or the indexer? I'd prefer to do this on the forwarder if possible.
2.) Does restarting the splunk forwarder engage the changes? Or is there something else I need to do?
3.) Is there any way to monitor logs as they come into splunk? (similar to tail -f)
4.) Do you see anything wrong with my syntax?

Thanks in advance guys! I really appreciate the help!

Tags (2)
1 Solution

sgundeti
Path Finder

Go through the props.conf example on below link

http://docs.splunk.com/Documentation/Splunk/6.2.1/admin/Propsconf

Coming to your questions
1. SED script works at index time, ie, it executed on _raw field. so answer is Indexer
2. Indexer restart is required
3. Use some sample log file and you can use preview option to verify all your rules.
4. refer to document, If you are replacing strings then it should be SED-alter=y/string1/string2/

View solution in original post

sgundeti
Path Finder

Go through the props.conf example on below link

http://docs.splunk.com/Documentation/Splunk/6.2.1/admin/Propsconf

Coming to your questions
1. SED script works at index time, ie, it executed on _raw field. so answer is Indexer
2. Indexer restart is required
3. Use some sample log file and you can use preview option to verify all your rules.
4. refer to document, If you are replacing strings then it should be SED-alter=y/string1/string2/

jpena323
Explorer

thanks - im going to try to add this to the indexer and see if it works

0 Karma

Marcia_Piccione
Engager

Can this be used in an intermediate forwarder?

0 Karma

landen99
Motivator

Does it not depend on where the data parsing phase is executed?

acharlieh
Influencer

It needs to be done on a Splunk instance doing parsing. That'd be an Indexer or Heavy Forwarder, but not a Universal Forwarder.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...