help on sourcetype customization for log parsing

[jip31]

hello

I need to parse the kind of logs below

Microsoft Windows [version 10.0.18363.1198]
(c) 2019 Microsoft Corporation. Tous droits réservés.

C:\WINDOWS\system32>dir C:\Tools\F
 Le volume dans le lecteur C s’appelle OSDisk
 Le numéro de série du volume est 88FB-20D5

Répertoire de C:\Tools\F

05/10/2020  06:48                 0 ABD-UPDATED.$w$
06/09/2018  13:27                 0 Access Runtime 2013 (15.0_32b) EN.$w$
06/09/2018  13:27                 0 Access Runtime 2013 (15.0_32b) ENP00.$w$
06/09/2018  13:30                 0 Acrobat Reader DC (2015.006_32b) ML.$w$
06/09/2018  13:30                 0 Acrobat Reader DC (2015.006_32b) MLP00.$w$
01/10/2019  08:01                 0 User Data Backup (2.2_32b) ML.$w$
01/10/2019  08:01                 0 User Data Backup (2.2_32b) MLP01.$w$

I need to create events for lines just after

Répertoire de C:\Tools\F

It means that i need a new event for each timestamp and that I need to delete the first part of the log

how to do this please?

[gcusello]

Hi @jip31,

let me understand: do you want to extract a field with the content of repertoire or to delete the other contents of the event before indexing?

if you want to extract the field, you can use a regex liek this:

| rex "(?ms)Répertoire de (?<repertoire>\w:(\\\w+)*)"

that you can test at https://regex101.com/r/TSuiwO/1

Ciao.

Giuseppe

[jip31]

Hi

Thanks but my question is about how doing this directly at sourcetype level

For example, what I have to add in LINE_BREAKER or somewhere else for having this log correctly parsed

Except if I am mistaken you regex works only for search usage

[gcusello · Accepted solution]

Hi @jip31,

I suppose that the logs to parse are the output of a script.

So, you could try something like this:

[your_sourcetype]
SHOULD_LINEMERGE=true
LINE_BREAKER=([\r\n]+)
NO_BINARY_CHECK=true

Ciao.

Giuseppe

[jip31]

Thanks to you

[gcusello]

Hi @jip31.,

good for you.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉