Creating a Dashboard

Follow

Smooth Operator

• August 17, 2022 05:25

Hi Guys, 

1. I am new to Sumo and trying to develop a dashboard to extract the following from logs and present them in a table. 

I want to extract: 

 

Who logged in: 

What time:

Verification status: 

How many attempts: 

 

Log samples: 

2022-08-17T05:07:25+10:00 exim-jsn jsnvpn-client-auth: Wed Aug 17 05:07:23 2022 Jane.alex/14.202.148.153:1194 VERIFY OK: depth=1, CN=vpn.exim.com.au

2022-08-17T05:13:35+10:00 exim-jsn jsnvpn-client-auth: Wed Aug 17 05:13:28 2022 Jasmin.lo/103.44.35.151:1194 VERIFY OK: depth=0, CN=Jasmin.lo

 

2. I want to change the time zone of the logs, how can I do it?

Please help. 

 

Thank you

 

0

• 

  Eli Jang

  • August 17, 2022 13:05

  1. Refer to here 

  2. Refer to here

  0

  Comment actions Permalink
• 

  Smooth Operator

  • August 18, 2022 06:02
  • Edited

  Thank you E Jang. Can you please help me with this?

  In Splunk I use Regex to extract the key items from a query and use Eval command to make the expression much meaningful and look pretty. 

  Ex: 

  | rex field=_raw "(?<Date>\w{3}\s+\d+ \d+:\d+:\d+) (?<hostname>.+) \d+: \w{3}.*User:(?<user>\w+).*:(?P<command>.......)"

  |eval "Command Execution on the Network" = Date + " " + "Enable Command on " + host + " was executed by " + user

  | table "Command Execution on the Network"

  
  I extracted a regex command for SumoLogic and I want to know what is the way to get a similar beautiful output from SumoLogic.
  From the below-mentioned regex, I want to have a table of which each row says

  On <Date> User <Name> has logged into <Server> <Connection> <status>

  
  | parse regex "\d+\S\d+\S\d+\w+\S\d+\S\d+\S\d+\S\d+\s(?<Server>\w+\S\w+\s\w+)\S\w+\S\w+\S\s(?<Date>\w+\s\w+\s\w+\s\w+\S\w+\S\w+)\s\w+\s(?<Name>\w+.\w+)\S\d+\S\d+\S\d+\d+\S\d+\S\d+\S\s(?<Connection>\w+)\s(?<status>\w+).*"

  Please help. 

  Thank you. 

  0

  Comment actions Permalink
• 

  Eli Jang

  • September 11, 2022 04:26
  • Edited

  Use concat operator.
  for example, 

  | concat ("On ", Date, " User ", Name, " has logged into ", Server, " ", Connection, " ", Status) as output
  | count by output

  0

  Comment actions Permalink
• 

  Smooth Operator

  • September 12, 2022 10:05

  Thank you Eli Jang. I really appreciate your help. 

  0

  Comment actions Permalink

Please sign in to leave a comment.