topic Re: parse snmp result in Getting Data In

parse snmp result

ragkna — Mon, 10 Mar 2014 01:54:31 GMT

Hello Experts,

I'm using snmp-modular--input app to get my device stats using multiple object ids (get next, not bulk). The result is shown below.

timestamp1 SNMPv2-SMI::enterprises."14685.3.1.5.1.0" = "48" SNMPv2-SMI::enterprises."14685.3.1.52.2.0" = "1" SNMPv2-SMI::enterprises."14685.3.1.52.3.0" = "14"

I have problem in splitting above result like this:-
timestamp1 SNMPv2-SMI::enterprises."14685.3.1.5.1.0" = "48"

timestamp1 SNMPv2-SMI::enterprises."14685.3.1.52.2.0" = "1"

timestamp1 SNMPv2-SMI::enterprises."14685.3.1.52.3.0" = "14"

I can then make use of rex expressions to get "14685.3.1.5.1.0" as field1 and "48" as field2 and use this as a name-value pair for dashboards.

Could someone please tell me how to split? or any other approach?

Re: parse snmp result

Ayn — Mon, 10 Mar 2014 07:05:02 GMT

I don't entirely follow why you need to split this into separate events? You're not limited to one extraction per event so you can just add all those extractions and have them apply to one single event instead.

Re: parse snmp result

ragkna — Mon, 28 Sep 2020 16:04:51 GMT

I have below rex expression which extract fields from above event.

source=snmp |eval _raw = split(_raw, "SNMPv2-SMI::enterprises.") | mvexpand _raw|rex "[^\"\n]*\"(?P[^\"]+)\"(?P[^\"]+)\"(?P[^\"]+)"

Result of above query idexed to:
FIELDNAME1=14685.3.1.5.1.0, 14685.3.1.52.2.0 and 14685.3.1.52.3.0
FIELDNAME2= '=' (Assigned to 'equal to')
FIELDNAME3= 48,1, and 14

Now, I'm unable to correlate between FIELDNAME1 and FIELDNAME3, which I need as name-value pair. If I split this into multiple and extract then resulted index holds FIELDNAME1='14685.3.1.5.1.0' and FIELDNAME3='48'. I do not need to correlate in this case.
Please let me know If you can give better idea.

Re: parse snmp result

ragkna — Mon, 10 Mar 2014 11:16:58 GMT

Ayn- Please check below comment..

Re: parse snmp result

ragkna — Tue, 11 Mar 2014 23:25:02 GMT

Can someone pl give insight on this problem?