How to modify Windows Servers events from multiline to a single line format

Hello,

We have about 900 Windows servers which are being indexed by our single logging system(splunk enterprise server). We are then forwarding these server logs in a standard syslog format to a 3rd party system. The 3rd party system perceives the logs in a multiline format. We need to convert them to single line because they do not support multiline.

Here is an event example from the 3rd party system:

    Dec 29 07:47:18 172.25.32.44 12/29/2014 02:47:17 AM
    Dec 29 07:47:18 172.25.32.44 LogName=Security
    Dec 29 07:47:18 172.25.32.44 SourceName=Microsoft Windows security auditing.
    Dec 29 07:47:18 172.25.32.44 EventCode=4689
    Dec 29 07:47:18 172.25.32.44 EventType=0
    Dec 29 07:47:18 172.25.32.44 Type=Information
    Dec 29 07:47:18 172.25.32.44 ComputerName=MYSERVER.dev.ad
    Dec 29 07:47:18 172.25.32.44 TaskCategory=Process Termination
    Dec 29 07:47:18 172.25.32.44 OpCode=Info
    Dec 29 07:47:18 172.25.32.44 RecordNumber=9663387
    Dec 29 07:47:18 172.25.32.44 Keywords=Audit Success
    Dec 29 07:47:18 172.25.32.44 Message=A process has exited.
    Dec 29 07:47:18 172.25.32.44 Subject:
    Dec 29 07:47:18 172.25.32.44 Security ID: NT AUTHORITY\LOCAL SERVICE
    Dec 29 07:47:18 172.25.32.44 Account Name: LOCAL SERVICE
    Dec 29 07:47:18 172.25.32.44 Account Domain: NT AUTHORITY
    Dec 29 07:47:18 172.25.32.44 Logon ID: 0x3e5
    Dec 29 07:47:18 172.25.32.44 Process Information:
    Dec 29 07:47:18 172.25.32.44 Process ID: 0xa84
    Dec 29 07:47:18 172.25.32.44 Process Name: D:\Program Files (x86)\Citrix\HealthMon\Tests\Citrix\RequestTicket.exe
    Dec 29 07:47:18 172.25.32.44 Exit Status: 0x0
     
     

How can we go about modifying the feed/events from a standard multiline format to a single line format?

I was told perhaps using regex to change the line breaks to some other delimiter could work.

Please advise as to how we can mod the multiline format to single line format?

--
Please advise if you need more details

Many thanks,

T
tobe1424Asked:
Who is Participating?
 
ozoConnect With a Mentor Commented:
#!/usr/bin/perl -lna
BEGIN{$"="; "}
$d=join" ",splice @F,0,4;
if( $d ne $p && @d ){
    print "$d @d";
    @d=();
}
$p=$d;
push @d,(join" ",@F)=~s/:\s?/=/r;
END{print "$d @d"}
0
 
ozoCommented:
What should the single line format look like?
0
 
tobe1424Author Commented:
It took a while for me to obtain the format from my team. Here is how it should look:

Dec 29 07:47:18 172.25.32.44 12/29/2014 02:47:17 AM LogName=Security; SourceName=Microsoft Windows security auditing.; EventCode=4689; EventType=0; Type=Information; ComputerName=MYSERVER.dev.ad; TaskCategory=Process Termination; OpCode=Info; RecordNumber=9663387; Keywords=Audit Success; Message=A process has exited.; Subject=; Security ID=NT AUTHORITY\LOCAL SERVICE; Account Name=LOCAL SERVICE; Account Domain=NT AUTHORITY; Logon ID=0x3e5; Process Information=; Process ID=0xa84; Process Name=D:\Program Files (x86)\Citrix\HealthMon\Tests\Citrix\RequestTicket.exe; Exit Status=0x0

--

T
0
What Kind of Coding Program is Right for You?

There are many ways to learn to code these days. From coding bootcamps like Flatiron School to online courses to totally free beginner resources. The best way to learn to code depends on many factors, but the most important one is you. See what course is best for you.

 
tobe1424Author Commented:
Thanks so much ozo. I will test this.

cheers
0
 
tobe1424Author Commented:
newb q

is this a regular expression in perl ?
0
 
tobe1424Author Commented:
would i need to run this perl script at the indexer or on an intermediate server ?

from the indexer the windows event logs are convert/forwarded to a 3rd party appliance ( a log collector/aggregator) which the logs show with a date/time stamp on ever single line break. Even though we assume we are correctly configured to forward/convert the logs from wins to a syslog format.

t
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.