https://community.splunk.com/t5/Getting-Data-In/SNMP-data-parsing/m-p/76215#M15554 <P>a) use rather regex field extraction. <A href="http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Createandmaintainsearch-timefieldextractionsthroughconfigurationfiles">Fields and field extractions</A></P> <P>b) use the table command. <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Table">Table</A></P> Thu, 23 Feb 2012 13:33:14 GMT MarioM 2012-02-23T13:33:14Z https://community.splunk.com/t5/Getting-Data-In/SNMP-data-parsing/m-p/76214#M15553 <P>Hi </P> <P>I have taken SNMP data into splunk through a CSV conversion of polled data. The sample data looks as below</P> <P>1.<EM>cgdAnswerType</EM>.<STRONG>173</STRONG>, .1.3.6.1.4.1.9.9.595.1.5.2.1.2.173,Integer,<EM>2</EM><BR /> 2.<EM>cgdAnswerAddress</EM>.<STRONG>173</STRONG>, .1.3.6.1.4.1.9.9.595.1.5.2.1.4.173, Octetstring, <EM>10.1.1.1</EM><BR /> 3.<EM>cgdAnswerName</EM>.<STRONG>173</STRONG>, .1.3.6.1.4.1.9.9.595.1.5.2.1.5.173,OctetString,<EM><A href="http://www.example.com">www.example.com</A></EM></P> <P>The challenge I have is <BR /> a) the common factor is a random number and it is part of the field and not a value. Also the value of one field is another field such as cgdAnswerName is <A href="http://www.example.com">www.example.com</A>.<BR /> I tried extract with delimiters of '.' but didnt work out. How can I use 173 in this case as a field and <BR /> b) Table the output as<BR /> Number | cgdAnswertype =2 | cgdAnswerAddress = 10.1.1.1 | cgdAnswerName = <A href="http://www.example.com">www.example.com</A></P> <P>Thanks in advance</P> Wed, 22 Feb 2012 12:41:48 GMT https://community.splunk.com/t5/Getting-Data-In/SNMP-data-parsing/m-p/76214#M15553 raki 2012-02-22T12:41:48Z https://community.splunk.com/t5/Getting-Data-In/SNMP-data-parsing/m-p/76215#M15554 <P>a) use rather regex field extraction. <A href="http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Createandmaintainsearch-timefieldextractionsthroughconfigurationfiles">Fields and field extractions</A></P> <P>b) use the table command. <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Table">Table</A></P> Thu, 23 Feb 2012 13:33:14 GMT https://community.splunk.com/t5/Getting-Data-In/SNMP-data-parsing/m-p/76215#M15554 MarioM 2012-02-23T13:33:14Z