Key-value pair extraction -- regex help

koshyk — Wed, 13 Sep 2017 17:02:29 GMT

We have some snmp data and want to extract the data as a key-value pair

Sample

var.12345.5.5 = INTEGER: 10 myTag::var.12345.5.9 = STRING: "abc"    myTag::var.12345.5.3 = STRING: "admin"  myTag::var.12345.5.4 = STRING: "developer"
var.12345.5.5 = INTEGER: 10 myTag::var.12345.5.9 = STRING: "xyz"    myTag::var.12345.5.3 = STRING: "user1"  myTag::var.12345.5.4 = STRING: "support"

output required

var_12345_5_9,var_12345_5_3,var_12345_5_4
abc,admin,developer
xyz,user1,support

I tried a basic

REGEX=var\.([^ ]+)\s=\s(\S+)
FORMAT = $1::$2
CLEAN_KEYS = true

But can you please help in making it a bit more better?

Re: Key-value pair extraction -- regex help

somesoni2 — Wed, 13 Sep 2017 17:31:46 GMT

Try this

REGEX=(var\S+)\s+=\s+[^\"]+([^\"]+)
FORMAT = $1::$2
CLEAN_KEYS = true

Re: Key-value pair extraction -- regex help

koshyk — Thu, 14 Sep 2017 09:18:54 GMT

cheers. it worked. I had to make a slight amendment, but the concept is the same.

topic Re: Key-value pair extraction -- regex help in Splunk Search

Key-value pair extraction -- regex help

Re: Key-value pair extraction -- regex help

Re: Key-value pair extraction -- regex help