HI
I need to extract the fields from the raw Cisco umbrella logs. Is there any add-on for this one or do I have to extract the fields manually?
"2015-01-16 17:48:41","ActiveDirectoryUserName","ActiveDirectoryUserName,ADSite,Network","10.10.1.100","24.123.132.133","Allowed","1 (A)","NOERROR","domain-visited.com.","Social Networking"
How to extract the fields:
ActiveDirectoryUserName as user
ADSite
Network
Allowed as action
domain-visited.com. as URL
Social Networking as category
Or just use this add-on which already does this for you and is CIM compliant: https://github.com/inspired/TA-OpenDNS
See the readme file for instructions on setting up your inputs using the Splunk AWS Add-on. Set the sourcetype to opendns:dnslog
Like this:
... | rex "^(?:\"[^\",]+\",)\"(?<user>[^\",]+)\",\"(?<user2>[^\",]+),(?<ADSite>[^\",]+),(?<Network>[^\",]+)\",(?:\"[^\",]+\",){2}\"(?<action>[^\",]+)\",(?:\"[^\",]+\",){2}\"(?<URL>[^\",]+)\",\"(?<category>[^\",]+)\""
Thanks woodcock,
How to add this in props.conf