Getting Data In

Custom Sourcetype Challenges

sloshburch
Splunk Employee
Splunk Employee

Using splunk 5.0.2 (although tested on splunk 6 as well - same challenges).

We're looking to use splunk to store audits of what software is on our systems. In Windows, we're trying to use "Get-WmiObject -Class Win32_Product" in powershell. This is defined in my inputs.conf as a [script://./bin/script.bat] stanza.

The props.conf for this sourcetype is:

[SloshBurchsSourceType]
SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n]+)Name
DATETIME_CONFIG = CURRENT
REPORT-SloshBurchsSourceType = SloshBurchsSourceType

A single event in splunk is coming in correctly as a block like this:

Name            : Adobe Shockwave Player 12.0
Vendor          : Adobe Systems, Inc
Version         : 12.0.4.144
Caption         : Adobe Shockwave Player 12.0
InstallLocation : C:\Windows\SysWOW64\Adobe\
InstallDate     : 20130917

I've set my transforms.conf to

[SloshBurchsSourceType]
DELIMS="\r\n", ":"

This isn't working - I'm not getting any of the fields. I'm guessing it's because of the : in the InstallLocation.

I tried switching to this transform.conf but still nothing. I'm guessing I'm using the regex wrong.

[SloshBurchsSourceType]
REGEX = (?<_KEY_1>.+)\s+:\s+(?<_VALUE_1>.+)
FORMAT = $1::$2

I want my sourcetype to automatically extract any "name : value" pairs from this without me having to list out the field names. I want splunk to dynamically detect the name value pairs in this sourcetype in the same way that is does, out of the box, for "name=value" format.

Any tips? Ideas what I'm doing wrong?

Thanks for any responses!

0 Karma
1 Solution

lguinn2
Legend

Your LINEBREAKER setting is consuming the "Name" characters at the beginning of the event. I would avoid using LINEBREAKER. Try this instead for props.conf

[SloshBurchsSourceType]
SHOULD_LINEMERGE=true
BREAK_ONLY_BEFORE = ^Name\s+\:
DATETIME_CONFIG = CURRENT
REPORT-SloshBurchsSourceType = SloshBurchsSourceType

I think that your first version of transforms.conf is probably fine.

View solution in original post

0 Karma

lguinn2
Legend

Your LINEBREAKER setting is consuming the "Name" characters at the beginning of the event. I would avoid using LINEBREAKER. Try this instead for props.conf

[SloshBurchsSourceType]
SHOULD_LINEMERGE=true
BREAK_ONLY_BEFORE = ^Name\s+\:
DATETIME_CONFIG = CURRENT
REPORT-SloshBurchsSourceType = SloshBurchsSourceType

I think that your first version of transforms.conf is probably fine.

0 Karma

lguinn2
Legend

Well, since the string "Name:" is actually consumed by your LINEBREAKER setting, it will throw off all the field extractions. That's why I made this recommendation. Plus, your use of LINEBREAKER also makes your data look different in Splunk than it does in the original file, which could throw users off too.

0 Karma

sloshburch
Splunk Employee
Splunk Employee

The events were separated correctly. The issue I am facing is how to separate the name : value pairs within the atomic events that I've created. Sorry if that was unclear.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...