Getting Data In

trouble breaking log events

JeffTanYH
Engager

I have several text format log files in which I need help in linebreaking them into the appropriate events that I need. This is an exmaple of what my file looks like:

====================================================

LOGS_BEGIN: DO_LOG

====================================================

====================================================

-rw------- 1 root root 3505 Apr 23 12:58 /var/adm/sulog

====================================================

SU 02/12 16:53 - pts/1 hkim-root

SU 02/12 16:53 + pts/1 hkim-root

SU 02/13 13:10 + ??? root-sys

SU 02/16 13:10 + ??? root-sys

SU 02/17 13:10 + ??? root-sys

SU 02/20 13:10 + ??? root-sys

====================================================

====================================================

-rw------- 1 root root 99999999 Apr 24 15:25 /var/log/messages

====================================================

Apr 24 14:30:01 999999999999 crond(pam_unix)[13043]: session opened for user root by (uid=0)

Apr 24 14:30:01 999999999999 crond(pam_unix)[13045]: session opened for user root by (uid=0)

Apr 24 14:30:01 999999999999 su(pam_unix)[13049]: session opened for user iscan by (uid=0)

Apr 24 14:30:01 999999999999 crond(pam_unix)[13043]: session closed for user root

====================================================

====================================================

-rw------- 1 root sys 2984 Apr 11 2006 /var/adm/loginlog

====================================================

vkaliya:/dev/pts/1:Wed May 4 11:14:34 2005

vkaliaya:/dev/pts/1:Wed May 4 11:14:43 2005

vkaliya:/dev/pts/1:Wed May 4 11:14:34 2005

vkaliaya:/dev/pts/1:Wed May 4 11:14:43 2005

vkaliya:/dev/pts/1:Wed May 4 11:14:55 2005

vkaliya:/dev/pts/1:Wed May 4 11:15:06 2005

====================================================

====================================================

I need to be able to filter out the top part of the log,which consist of the 1st line till the 6th line (shown below)this applies to the messagelog and loginlog as well

====================================================

LOGSBEGIN: DOLOG

====================================================

====================================================

-rw------- 1 root root 3505 Apr 23 12:58 /var/adm/sulog

====================================================

After which,I will need each and every line to be a seperate event (shown below)

SU 02/15 10:28 + pts/1 hkim-root

SU 02/15 13:10 + ??? root-sys

I would also have to filter out the last part of the log(shown below)

====================================================

====================================================

I have tried several props.conf but it doesn't to be working!! Please help me!
TAKE NOTE: at the loginlog section,the time format is different from the message and sulog section!!!!

0 Karma

emcollections
New Member
0 Karma

emcollections
New Member
0 Karma

emcollections
New Member
0 Karma

emcollections
New Member
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...