About manoj06

manoj06

Hello Team,Can you please help me with parsing the CSV log? While there are no errors during parsing, I am only able to parse common fields.Here are some details of the log:event_type: GENERIC_EVENTvendor_name: "Zscaler"product_name: "Zscaler Interne...

manoj06

Hello Team,Can someone assist me with pattern matching and parsing this type of log in Chronicle?"version account-id interface-id srcaddr dstaddr dstport srcport protocol packets bytes end start action log-status vpc-id subnet-id instance-id tcp-flag...

manoj06

Hello Team, we are trying to parse fields from json log format, but there are nested fields Within the "Message".we user the json filter and other different steps.All the fields inside the "Message" are not being parsed, Please chek the sample log fo...

manoj06 · 04-02-2024

Hello Team,Not able to parser the required fields from the oracle database audit logs.Sample log - <13>1 20**-0*-**T14:51:00+05:30 md****1 journal 3491695 - [meta sequenceId="2"] Oracle Audit[3491695]: LENGTH : '240' ACTION :[7] 'CONNECT' DATABASE US...

manoj06 · 12-27-2023

Hello All,Please help us parse the endTimeISO, startTimeISO and eventTimeISO from the below log."{\"hostName\":\"ManageEngine Endpoint Central 11\",\"module\":\"System Manager\",\"priority\":\"Information\",\"timeDuration\":\"0\",\"application\":\"Ma...

manoj06

I have defined start_time at the top, The field Start_time is working perfectly fine for all the other logs except this type of log .

manoj06

this is the log "version account-id interface-id srcaddr dstaddr dstport srcport protocol packets bytes end start action log-status vpc-id subnet-id instance-id tcp-flags pkt-srcaddr pkt-dstaddr region"

manoj06

Hi, tried the above method, matched all the patterns as you mentioned still not able to parse the fields. It shows start_time not found "generic::internal: pipeline failed: filter date (4) failed: start_time not found"

manoj06

I have user the statedump, the fields are getting mapped.I will use the above syantx, hopefully it works

manoj06

Hi bsalvatore,I tried the json filter, it dosent work for the fileds inside Message.{ "EventReceivedTime": "202*-0*-** 21:44:45", "SourceModuleName": "in_json_log", "SourceModuleType": "im_file",These fields will work with the json filter but the fie...

My Stats

manoj06's Bio

Badges manoj06 Earned

Recent Activity

CSV log Parsing

parser

Json parsing inside Message

Chronicle parser for Oracle DB audit logs

How can I parse Timestamp?

Re: parser

Re: parser

Re: parser

Re: Json parsing inside Message

Re: Json parsing inside Message