Splunk Search

best practice for custom syslog field extraction

Skins
Path Finder

I have a syslog file and none of the default sourcetypes give me what i want - so i have:

any advice on best approach for props.conf

Apr 15 16:54:01 HOSTNAMEX Group CfgSrvc: hd[0]: cfgcore: WritePhase2(Security,system,security.authentication.accounts[0].adminaccount.failedlogincount) value update "9234" => "9235"
Apr 15 16:54:01 HOSTNAMEX Group CfgSrvc: hd[0]: cfgcore: callback DynamicValidate(Security,"807847",system,{security[0].authentication[0].accounts[0].adminaccount[0].failedlogincount[0]/local,"9235"},"PlatCfgS/5/01-0"[17])
Apr 15 16:54:01 HOSTNAMEX Group Security: hd[0]: SecurityService: login login failed, increment # of failed logins
Apr 15 16:54:01 HOSTNAMEX Group Security: hd[0]: SecurityService: login login failed, setLoginResult 6
Apr 15 16:54:01 HOSTNAMEX Group Security: hd[0]: SecurityService:  If loginSuccess is false ( 
Apr 15 16:54:01 HOSTNAMEX Group Security: hd[0]: SecurityService: LocalAuthenticator::login, role 3 loginSuccess 0
Apr 15 16:54:01 HOSTNAMEX Group Security: hd[0]: SecurityService: SecurityServiceLoginRequest(): username: admin
Apr 15 16:54:01 HOSTNAMEX Group logcat: hd[0]: UAppSvcs(2132): (legacyapi) API:OUT:Password: 
Apr 15 16:54:01 HOSTNAMEX Group logcat: hd[0]: UAppSvcs(2132): (legacyapi) API:OUT: -- password failed, retry --

gratzi

Tags (1)
0 Karma

chris_barrett
Communicator

A quick Google would suggest that the logs are coming from a Polycom system/device of some sort.

The following is completely untested but itshould be enough to make start. You didn't say what the data is currently being sourcetype as so I've catered for it coming in as "syslog" and it then being overridden to "polycom". Ideally though it would be easier if the events were sourcetyped as polycom by the monitor stanza.

If you're open to providing me with a bigger sample of logs then I'd be happy to assist with a view to developing a TA that could be released to SplunkBase for the benefit of anyone else with these systems/devices.

--- props.conf ---

[syslog]
TRANSFORMS-override_sourcetype_for_polycom = override_sourcetype_for_polycom

[polycom]
SHOULD_LINEMERGE = false
TIME_PREFIX = ^
EXTRACT-polycom_basics = \s(?<hostname>\S+?)\sGroup\s(?<unknown_01>[^:]+?):\s(?<unknown_02>[^:]+?):\s(?<unknown_03>[^:]+?):\s(?<message>.+?)$

--- transforms.conf ---

[override_sourcetype_for_polycom]
SOURCE_KEY = _raw
REGEX = \sGroup\s(CfgSrvc|Security|logcat|):\s
DEST_KEY = MetaData:Sourcetype
FORMAT = sourcetype::polycom
0 Karma

kmorris_splunk
Splunk Employee
Splunk Employee

If there isn't a Splunk Add-on for this source, you will need to teach Splunk what the fields are. This can be done via the GUI, which will update props.conf for you for that sourcetype. https://docs.splunk.com/Documentation/Splunk/7.2.5/Knowledge/FXSelectSamplestep

You could also do it by manually editing the props.conf if you are more adventurous.
https://docs.splunk.com/Documentation/Splunk/7.2.5/Knowledge/Createandmaintainsearch-timefieldextrac...

0 Karma

skalliger
SplunkTrust
SplunkTrust

Best way to go would be to get familiar with the Add-on builder.

Skalli

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...