Getting Data In

How to configure SEDCMD in props.conf?

jpena323
Explorer

Hi guys,

I am having a really hard time figuring out how to get the sedcmd to work in props.conf. I'd appreciate any help you can lend. Here is an example of my config:

PROPS.CONF

[source::.../syslog_logs/*srx*/user.info.log]
SEDCMD-removeunwanted1 = s/\s(src-nat-rule-name=\"[^\"]+\")//
SEDCMD-removeunwanted2 = s/\s(source-zone-name=\"[^\"]+\")//
SEDCMD-removeunwanted3 = s/\s(destination-zone-name=\"[^\"]+\")//
SEDCMD-alter1 = s/destination/dst/g
SEDCMD-alter2 = s/source/src/g
SEDCMD-alter3 = s/address/ip/g
SEDCMD-alter4 = 's/protocol-id="17"/UDP/'
SEDCMD-alter5 = 's/protocol-id="6"/TCP/'
SEDCMD-alter6 = 's/protocol-id="1"/ICMP/

The point of this is to simplify our logs from Juniper SRXs. When I do a "--debug props list | grep SEDCMD", I see the commands listed. Not sure what I'm doing incorrectly, but have a couple of questions in addition to any advice you guys have.

1.) Does this props.conf have to be configured on the forwarder or the indexer? I'd prefer to do this on the forwarder if possible.
2.) Does restarting the splunk forwarder engage the changes? Or is there something else I need to do?
3.) Is there any way to monitor logs as they come into splunk? (similar to tail -f)
4.) Do you see anything wrong with my syntax?

Thanks in advance guys! I really appreciate the help!

Tags (2)
1 Solution

sgundeti
Path Finder

Go through the props.conf example on below link

http://docs.splunk.com/Documentation/Splunk/6.2.1/admin/Propsconf

Coming to your questions
1. SED script works at index time, ie, it executed on _raw field. so answer is Indexer
2. Indexer restart is required
3. Use some sample log file and you can use preview option to verify all your rules.
4. refer to document, If you are replacing strings then it should be SED-alter=y/string1/string2/

View solution in original post

sgundeti
Path Finder

Go through the props.conf example on below link

http://docs.splunk.com/Documentation/Splunk/6.2.1/admin/Propsconf

Coming to your questions
1. SED script works at index time, ie, it executed on _raw field. so answer is Indexer
2. Indexer restart is required
3. Use some sample log file and you can use preview option to verify all your rules.
4. refer to document, If you are replacing strings then it should be SED-alter=y/string1/string2/

jpena323
Explorer

thanks - im going to try to add this to the indexer and see if it works

0 Karma

Marcia_Piccione
Engager

Can this be used in an intermediate forwarder?

0 Karma

landen99
Motivator

Does it not depend on where the data parsing phase is executed?

acharlieh
Influencer

It needs to be done on a Splunk instance doing parsing. That'd be an Indexer or Heavy Forwarder, but not a Universal Forwarder.

0 Karma
Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...