Getting Data In

trouble breaking log events

JeffTanYH
Engager

I have several text format log files in which I need help in linebreaking them into the appropriate events that I need. This is an exmaple of what my file looks like:

====================================================

LOGS_BEGIN: DO_LOG

====================================================

====================================================

-rw------- 1 root root 3505 Apr 23 12:58 /var/adm/sulog

====================================================

SU 02/12 16:53 - pts/1 hkim-root

SU 02/12 16:53 + pts/1 hkim-root

SU 02/13 13:10 + ??? root-sys

SU 02/16 13:10 + ??? root-sys

SU 02/17 13:10 + ??? root-sys

SU 02/20 13:10 + ??? root-sys

====================================================

====================================================

-rw------- 1 root root 99999999 Apr 24 15:25 /var/log/messages

====================================================

Apr 24 14:30:01 999999999999 crond(pam_unix)[13043]: session opened for user root by (uid=0)

Apr 24 14:30:01 999999999999 crond(pam_unix)[13045]: session opened for user root by (uid=0)

Apr 24 14:30:01 999999999999 su(pam_unix)[13049]: session opened for user iscan by (uid=0)

Apr 24 14:30:01 999999999999 crond(pam_unix)[13043]: session closed for user root

====================================================

====================================================

-rw------- 1 root sys 2984 Apr 11 2006 /var/adm/loginlog

====================================================

vkaliya:/dev/pts/1:Wed May 4 11:14:34 2005

vkaliaya:/dev/pts/1:Wed May 4 11:14:43 2005

vkaliya:/dev/pts/1:Wed May 4 11:14:34 2005

vkaliaya:/dev/pts/1:Wed May 4 11:14:43 2005

vkaliya:/dev/pts/1:Wed May 4 11:14:55 2005

vkaliya:/dev/pts/1:Wed May 4 11:15:06 2005

====================================================

====================================================

I need to be able to filter out the top part of the log,which consist of the 1st line till the 6th line (shown below)this applies to the messagelog and loginlog as well

====================================================

LOGSBEGIN: DOLOG

====================================================

====================================================

-rw------- 1 root root 3505 Apr 23 12:58 /var/adm/sulog

====================================================

After which,I will need each and every line to be a seperate event (shown below)

SU 02/15 10:28 + pts/1 hkim-root

SU 02/15 13:10 + ??? root-sys

I would also have to filter out the last part of the log(shown below)

====================================================

====================================================

I have tried several props.conf but it doesn't to be working!! Please help me!
TAKE NOTE: at the loginlog section,the time format is different from the message and sulog section!!!!

0 Karma

emcollections
New Member
0 Karma

emcollections
New Member
0 Karma

emcollections
New Member
0 Karma

emcollections
New Member
0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...