Splunk Search

How to parse log with a lot of indicators?

anissabnk
Path Finder

Hello everyone, 

I have a question for you, and I need your help please 🙂

I have some logs, but the parsing isn't done. 

In a same log, I have a lot of indicators and I need to extract the fields :

-cpu_model

device_type:
-distinguished_name:
- entity: 
- last_boot_duration: 

- last_ip_address: 
- last_logon_duration: 

last_logon_time:

 -   last_system_boot: 
   -  mac_addresses: [

00:42:38:CA:81:72
00:42:38:CA:81:7300:42:38:CA:81:76
         02:42:38:CA:81:72
         74:78:27:91:41:BB
         B0:9F:80:55:40:44 

       ]

      - name: PCW-TOU-76566
       -number_of_days_since_last_boot:
      - number_of_days_since_last_logon: 
     -  number_of_monitors: 3
       - os_version_and_architecture: Windows 10 Pro 21H2 (64 bits)
      - platform: windows
      - score:Device performance/Boot speed: null
       -system_drive_capacity: 506333229056
     -  system_drive_usage: 0.19
      - total_nonsystem_drive_capacity: 0
       -total_nonsystem_drive_usage: null
       -total_ram: 8589934592

 

anissabnk_0-1674668405561.png

The log is like this :

anissabnk_0-1674669178508.png

What can I do to have the fields extracted to develop my indicators ? 

The regex method is not possible in this case, can I use rex command ? and how I can do for this example ? 

I need your help, thank you so much 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

This looks like JSON. Use the spath command

| spath

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

This looks like JSON. Use the spath command

| spath
Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...