All Apps and Add-ons

Access_log delimiter problem

Norling80
Path Finder

Hi

I have a JBoss access-log source with space as the delimiter between the fields, here is the log structure:
"%{Host}i %{X-Forwarded-For}i %{Referer}i %{User-agent}i %h %l %u %t %r %s %b

I have defined the sourcetype in props.conf and set the log structure in transforms.conf (see config below), my problem is that several of the fields in the logs contains space for example the UserAgent field and this mess up the entire import.

Any suggestions how to ignore the spaces within the different fields?

Current configuration:
Props.conf
[lcaccesslog]
SHOULD_LINEMERGE = False
pulldown_type = 1
REPORT-getfields = lcaccesslog_fields

Transforms.conf
[lcaccesslog_fields]
DELIMS=" "
FIELDS = "Host","X-ForwardedFor","Referer","UserAgent","RemoteHost","RemoteLogicalUserName","RemoteUser","DateTime","Method","StatusCode","BytesSent"

regards
/Magnus

0 Karma

peter_krammer
Communicator

First of all, if possible change the log structure to something easier to analyse.
But if this is not possible here is something you can try:
Are the fields wrapped in either " or ' ?
Because than you could us a DELIMS="\" \"" or DELIMS="'"

if you can change the format use something like this:
field1="value1", field2="value2",...

Hope this helps.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...