Parsing Studio

The Parsing Studio builds the Splunk parsing for a log in six steps: Parse, Normalise, Tag, Impact, Review and Deploy. It writes standard props.conf, transforms.conf, eventtypes and tags in the Vyrux app, so it never edits another app's files.

Parse: every field found in the sample, colour-coded in the events.

Impact: which rules get every field they need after the change.

After deploy, Vyrux checks real events to confirm the fields now appear. A parser change can be rolled back from the change log.