Getting Data In

REGEX help with ingesting XML file. Timestamp not working correctly

joesrepsol
Path Finder

Looking to extract the "2017-06-23 15:48:56.218" from the 2nd line in the log and use it for the timestamp when ingesting this xml log into Splunk. Today Splunk is picking up the wrong timestamp for the timestamp recognition, which causes problems.

Thinking that I need to define some REGEX in a props.conf/transforms.conf file but missing the REGEX experience to pull this out.

Help?

<auditEvent encrypted="n" signed="n">
    <localTime>2017-06-23 15:48:56.218 -0700</localTime>
    <time>2017-06-23 22:48:56.218</time>
    <utc>2017-06-23 22:48:56.218</utc>
    <sessionId>25</sessionId>
    <msg>
        <msgID>AUD0117E</msgID>
        <msgText>SessionId: 25 - Login attempt to CM by intruder through local store Failed with an operator role of UNKNOWN ROLE</msgText>
        <condCode>8</condCode>
    </msg>
</auditEvent>

using Splunk Enterprise 6.5.0 (Linux)

Tags (1)
0 Karma

joesrepsol
Path Finder

Also noticed that Splunk is not automatically figuring out which breaks to use for the entire event... WHOA. In this case, it's XML and I need to also figure out how to tell splunk that each event starts with:

<auditEvent encrypted="n" signed="n">

and ends with:

</auditEvent>
0 Karma

joesrepsol
Path Finder

Clarification...

Looking to pull the date/time stamp between "" and "-0700"

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...