Security

no idea where to start

leadmagnet
New Member

Just installed splunk and have it indexing several servers event logs. Nifty! 😉

Thought it would be nice to have it chew on my servers VPN logs. I have the CSV definition from MS (here) and splunk can get to the files.

However, it stops on the first record, first file as it cannot parse the file correctly.

How do I get it to go!?

Tags (1)
0 Karma

yannK
Splunk Employee
Splunk Employee

You may have to define a special parsing,
Take a sample and index it using an upload on a test index using the preview.
http://docs.splunk.com/Documentation/Splunk/latest/Data/Overviewofdatapreview

0 Karma

leadmagnet
New Member

Thanks for that, but I already tried this. The data is imported as a single line. The CSV definition does nto appear in the "interesting fields" list, because I haven't told it which comma seperated column is called what and what type of data it contains. To get even more complex, some of these fields (ref the previous link) need to "lookup" their actual value.

Still stumpped!

:S

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...