All Apps and Add-ons

I'm having some trouble with creating a field extraction using Regex

janderson19
Path Finder

Hello,

I'm currently working with F5 BigIP logs and attempting to extract peer status from the f5:bigip:syslog sourcetype.

examples of the 2 types of log I'm interested in:

Jan 5 13:10:58 TestServer notice mcpd[6300]: 01070727:5: Pool /Common/TesterHTTP_pool member /Common/WebServer:80 monitor status up. [ /Common/http_get11: up ] [ was down for 0hr:0min:4sec ]

.

Jan 5 15:16:54 TestServer notice mcpd[6300]: 01070638:5: Pool /Common/TesterHTTP_pool member /Common/WebServer:80 monitor status down. [ /Common/http_get11: down; last error: /Common/http_get11: No successful responses received before deadline. @2019/02/06 15:16:54. ] [ was up for 0hr:6mins:11sec ]

My props.conf contains the following stanza:

[f5:bigip:syslog]
TRANSFORMS-Status=PoolMemberStatus

And my transforms.conf contains the following stanza:

[PoolMemberStatus]
REGEX = \]:\s(?P<event_code>\d+:\d):\sPool\s(?P<ltm_pool>\S+)\smember\s(?P<ltm_member>\S+)\smonitor\sstatus\s(?P<ltm_monitor_status>\S+)\.\s\[(\s\S+)+\s\]\s\[\swas\s(?P<ltm_prev_status>\S+)\sfor\s(?P<ltm_prevstatus_time>\S+)\s\]

According to regex101, this should work, since Splunk uses PCRE for regex parsing, but I haven't been able to get Splunk to parse out the fields that I'm looking for.

I tried using Web UI field extractions for this, which came up with the following regex:

^(?:[^:\n]*:){3}\s+(?P<event_code>\d+:\d+):\s+(\w+\s+)+(?P<ltm_pool>[^ ]+) member (?P<ltm_member>[^ ]+)\s+(\w+\s+)+(?P<ltm_monitor_status>[a-z]+)[^\]\n]*\]\s+\[\s+\w+\s+(?P<ltm_prev_status>\w+)\s+(\w+\s+)+(?P<ltm_prevstatus_time>[^ ]+) 

If anyone has any ideas as to why this field extraction is failing, I'd really appreciate the help.

Thanks

0 Karma
1 Solution

janderson19
Path Finder

I'm an idiot. This works. Just had to go into "More Fields" and select it.

View solution in original post

janderson19
Path Finder

I'm an idiot. This works. Just had to go into "More Fields" and select it.

View solution in original post

woodcock
Esteemed Legend

Thanks for fessing up. It will help somebody else in the future.

janderson19
Path Finder

Happens to the best of us 🙂 I always hate seeing an OP abandon a thread when they figure out a problem, without disclosing the solution, so I try to always come back when I figure something out.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!