All Apps and Add-ons

Can't seem to get Infoblox DHCP to work


After going through all the different posts about Infoblox, DHCP, I thought that I had it, but I can't seem to get it to work properly. I installed the posix DHCP tool and updated all the Regex statements to deal with the Infoblox syslog changes. The regex should be working but while I can see all my events show up as dhcpd_events, when I search for any fields (ie dhcp_message), I get nothing.

I'm kind of new to Splunk so I'm sure that I'm missing something. Hopefully somebody can point me in the right direction.

Some examples of the Syslogs that I am getting:

Apr 15 20:01:00 dhcpd[15805]: DHCPINFORM from via
Apr 15 20:01:00 dhcpd[15805]: DHCPACK to (f8:bc:12:d5:0e:19) via eth1
Apr 16 02:55:26 dhcpd[15805]: DHCPREQUEST for from 00:1e:4a:92:02:30 (SEP001E4A920230) via uid 01:00:1e:4a:92:02:30 (RENEW)

Transforms.conf (backslashes are being stripped to I have replaced them with ' )

FORMAT=process::$1 dhcp_message::$2 src_ip::$3 dest_int::$4

FORMAT=process::$1 dhcp_message::$2 src_ip::$3 src_mac::$4 dest_int::$5

FORMAT=process::$1 dhcp_message::$2 src_ip::$3 src_nat_ip::$4 src_mac::$5 src_host::$6 dest_int::$7

Tags (2)
0 Karma


I've fixed it.
You have to change all the regex in transform.conf



and change the following line in: eventtypes.conf

search = process=dhcpd

search = dhcpd

0 Karma


The latest infoblox TA supports DHCP as a sourcetype:

Check out the documentation here:

TA is available here:

0 Karma

Splunk Employee
Splunk Employee

When you use ', do you mean \? If not, none of these REGEXes are good.

In [dhcpinform], do you get the variable process? If so, you have to look for error after and if not, then the entire regex is bad.
Are timestamps extracted correctly after your syslog-related changes?

In general, I would start working with the REGEX one capture group at a time.

0 Karma

Path Finder

Have you also updated the transform for [set-dhcpd-sourcetype]? Near the top of the transforms file, you also need to update the regex so it reads:


(I replaced slashes with the pipe character)

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!