We are feeding Venafi logs into Splunk and have trouble with records breaking at the wrong places.
This is the format of the input - all log records start with this:
10.213.32.41,4/16/2018 11:06 AM,0001001D,...
IP date time 8 hex-character event ID
and can have multiple lines per record.
Can someone suggest sourcetype configuration to correctly parse our logs?
Try this (props.conf on your indexer/heavy forwarder)
[Venafi_Logs]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)(?=\d{1.3}\.\d{1.3}\.\d{1.3}\.\d{1.3},\d+\/\d+\/\d+\s\d+\:\d+)
TIME_PREFIX = ^\d{1.3}\.\d{1.3}\.\d{1.3}\.\d{1.3},
TIME_FORMAT = %m/%d/%Y %H:%M %p
MAX_TIMESTAMP_LOOKAHEAD = 19