About poojithavasanth

poojithavasanth · ‎02-09-2023

Perfect. Thank you!

poojithavasanth · ‎02-09-2023

Thank you @richgalloway and @scelikok I did not get any error; however, I see timestamp being none. Also, the timestamp in the file is not same as the timestamp which is marked in blue.

poojithavasanth · ‎02-09-2023

Thanks for the reply @richgalloway I removed angle brackers for TIME_PREFIX and it did not work. I would want to extract timestamp and other fields from the event to display them.

poojithavasanth · ‎02-08-2023

This is very similar to a lot of XML parsing questions, however I have read through ~20 topics and am still unable to get my XML log to parse properly. Here is a sample of my XML file: <?xml version="1.0" encoding="UTF-8"?><AuditMessage xmlns:xsi="XMLSchema-instance" xsi:noNamespaceSchemaLocation="HL7-audit-message-payload_1_3.xsd"><EventIdentification EventActionCode="R" EventDateTime="2022-11-07T04:18:01"></EventIdentification></AuditMessage> <?xml version="1.0" encoding="UTF-8"?><AuditMessage xmlns:xsi="XMLSchema-instance" xsi:noNamespaceSchemaLocation="HL7-audit-message-payload_1_3.xsd"><EventIdentification EventActionCode="E" EventDateTime="2022-11-07T05:18:01"></EventIdentification></AuditMessage> Here are the entire contents of my props.conf file: [xxx:xxx:audit:xml] MUST_BREAK_AFTER = \</AuditMessage\> KV_MODE = xml LINE_BREAKER = ([\r\n]+) NO_BINARY_CHECK = true SHOULD_LINEMERGE = true TIMESTAMP_FIELDS = <EventDateTime> TIME_PREFIX = <EventDateTime> TIME_FORMAT = %Y-%m-%dT%H:%M:%S category = Custom disabled = false I would need your assistance to parse the events. Thank you.

poojithavasanth · ‎02-02-2023

Thanks @richgalloway . Appreciate your help!

poojithavasanth · ‎02-02-2023

Hello, I wanted a EVAL statement which manually adds a specified time may be "00:00:00" for the event containing only date component in them. Example of the file: (psv format) Poojitha Vasanth|21644|669194|Poojitha Vasanth|02/19/18|PRE-CLINIC VISIT| Current sourcetype: [sample:xx:audit:psv] EVAL-event_dt_tm = date FIELD_NAMES = "prsnl_name","prsnl_alias","person_alias","person_name","date","event_name" TIMESTAMP_FIELDS = "date" And, I have modified it to. EVAL-time = "00:00:00" EVAL-event_dt_tm = date.time FIELD_NAMES = "prsnl_name","prsnl_alias","person_alias","person_name","date","event_name" TIMESTAMP_FIELDS = "date","time" Even after this change, I am getting the ingested date and time and the actual log time. Could anyone please let me know where I have gone wrong?

poojithavasanth · ‎01-22-2023

Thaks for the inputs. I tried using the provided Regex; however it picks up space as the prsnl_last and then does not give any value in that column. Can we have a regex which picks up prsnl_last name only and then removes it while displaying them?

poojithavasanth · ‎01-19-2023

This Regex works! Thank you @ITWhisperer Just checking if we can create a Regex using a capturing group<prsnl_last> and then to remove the data within it? So that the first word assigns to <prsnl_last>, but the value would be null.

poojithavasanth · ‎01-19-2023

Hello, I have a Regex for splitting a Person full name into Person lastname, firstname and middlename. Regex used: (?<prsnl_last>\w+)([\s]*(?<prsnl_credentials>[\w]*)|)[\s]*,[\s]*(?<prsnl_first>\w+)([\s]*(?<prsnl_middle>[\w]+.*?)|) Now I would need to remove prsnl_last from the output. (Basically, to scrub the data from prsnl_last event) Output should be something like this. "Haikal" and "Campbeli" should be removed. Can someone please help me out? Thank you!

poojithavasanth · ‎01-17-2023

The first answer replaces (XXX) or any string I would want. I accept. However, I would have random characters before the sensitive data and not a specified character. For example: Exmaple 1) 0000|2019-01-07T14:20:12.000000Z|xxx|xxx, xxxx|xxx|M|xxx||PIEIGHT||xxx||Viewed|viewed patient data in registration(XXTEST, ORANGE CRUSH)|00000|| Example 2) 1111|2010-01-07T14:20:12.000000Z|xxx|xxx, lastname|yyy|M|xxx||PIEIGHT||xxx||error|view patient(XXTEST)|00000|| Example 3) 1234|1999-01-07T14:20:12.000000Z|xxx|xxx, xxxx|xxx|M|xxx||PIEIGHT||xxx||notviewed|search analyser (YYTEST, TEST)|00000|| a) Fields are separated using | (pipe) b) The string before (XXX) would be named as event_name. c) Should we use captured group for building a regex? Let me know if you would need any additional info. Thank you,

poojithavasanth · ‎01-17-2023

Thanks for the reply @gcusello Here in this case, event_name would be any random events. For example, it could be viewed patient data in registration, view patient, search analyser etc. Here event_name should accept any string and I would want a regex to srub the data within () after event_name. viewed patient data in registration(XXTEST, ORANGE CRUSH) view patient(XXTEST) search analyser (YYTEST, TEST) Could you please help me on Regex for the same. Thank you,

poojithavasanth · ‎01-17-2023

Hello, I have a log that look like this: Here each fields as its own field name, and viewed patient data in registration(XXTEST, ORANGE CRUSH) here is event_name. (Captured group to be used.) 0000|2019-01-07T14:20:12.000000Z|patientid|lastname, firstname|personlastname|M|middelname||PIEIGHT||MRN||Viewed|viewed patient data in registration(XXTEST, ORANGE CRUSH)|00000|| The one in red should be removed as it is sensitive patient data, for example (XXTEST, ORANGE CRUSH) should be removed. transforms.conf I have. [removedata] REGEX = ^(?:[^\|\n]|){13}(?P<event_name>[^\|]+)([^)]) On my props.conf I have REPORT-removedata= removedata But it is still not working: Do I need to use the field name, or change my regex? Am I applying the proper user of Transform? Thank you,

poojithavasanth · ‎10-13-2022

I see it recognizes the timestamp without adding TIME_PREFIX but with an error "could not use strptime to parse timetsamp". My goal is to clear the error, which is only possible by adding TIME_PREFIX which suits the situation.

poojithavasanth · ‎10-13-2022

Thanks for the providing this information. I still do not see it working.

poojithavasanth · ‎10-13-2022

File is in .txt format and file content are in psv (pipe-delimited) Also, Lookahead with 63 did not work too. I believe there should be some updates in TIME_PREFIX.

poojithavasanth · ‎10-13-2022

Yes, it is TIME_PREFIX

poojithavasanth · ‎10-13-2022

I have the data has "1111|xxx, xxx y|000000|111111|firstname, lastname|10/13/22 02:12:09|" I used TIME_FORMAT = %m/%d/%Y %H:%M:%S and Timestamp prefix = ^(?:[^\|\n]*\|){5} However, I still get an error stating could not use strptime to parse the timestamp. Would need help in providing timestamp prefix here.

Posts	17
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎10-13-2022

Online Status	Offline
Date Last Visited	‎02-09-2023 10:09 AM

How to parse XML and props.conf?

How to achieve providing timestamp field when even...

How to remove a word with Regex using Capturing gr...

How to achieve hiding sensitive data?

Splunk Time_format and Timestamp prefix option?

Re: How to parse XML and props.conf?

Re: How to parse XML and props.conf?

Re: How to parse XML and props.conf?

How to parse XML and props.conf?

Re: How to achieve providing timestamp field when ...

How to achieve providing timestamp field when even...

Re: To remove a word with Regex using Capturing gr...

Re: To remove a word with Regex using Capturing gr...

How to remove a word with Regex using Capturing gr...

Re: Transforms.conf - Hide sensitive data

Re: Transforms.conf - Hide sensitive data

How to achieve hiding sensitive data?

Re: Splunk Time_format and Timestamp prefix option...

Re: Splunk Time_format and Timestamp prefix option...

Re: Splunk Time_format and Timestamp prefix option

Re: Splunk Time_format and Timestamp prefix option

Splunk Time_format and Timestamp prefix option?