topic transforms.conf multiple $1 assignments in Getting Data In

transforms.conf multiple $1 assignments

Splunker — Mon, 13 Feb 2012 10:06:35 GMT

Folks,

Running Splunk v4.3 and trying to understand this phenomenon. In transforms.conf, something like this:

[transport] REGEX = (TCP|tcp|UDP|udp|ICMP|icmp) FORMAT = transport::$1 protocol::$1

Seems to only create the latter field (protocol), transport doesn't seem to exist. Is there any way i can make Splunk create both fields?

Thanks.

Re: transforms.conf multiple $1 assignments

RicoSuave — Mon, 13 Feb 2012 15:31:51 GMT

This is really going to depend on which fields show up first in your event. I'm going to assume that transport shows up first followed by protocol. The reason your current configuration isn't working is because you need to setup grouping in your regex. Try doing this instead.

[transport]
REGEX = (TCP|tcp|UDP|udp|ICMP|icmp)|(TCP|tcp|UDP|udp|ICMP|icmp)
FORMAT = transport::$1 protocol::$2

Let me know if this works.

Re: transforms.conf multiple $1 assignments

Splunker — Sun, 19 Feb 2012 07:10:25 GMT

Hey Joetron,

That should technically work for single-captures, but i realised multi-captures would get much more difficult. I opted to make the duplicate captures field-aliases instead.

So transport::$1 but protocol is an alias to transport.

The above was defined in an app on SplunkBase, which made me wonder if there was a way to do this, but now i think it's just a bug.. Will award you the points as your answer is correct 🙂