All Apps and Add-ons

I'm having some trouble with creating a field extraction using Regex

Path Finder


I'm currently working with F5 BigIP logs and attempting to extract peer status from the f5:bigip:syslog sourcetype.

examples of the 2 types of log I'm interested in:

Jan 5 13:10:58 TestServer notice mcpd[6300]: 01070727:5: Pool /Common/TesterHTTP_pool member /Common/WebServer:80 monitor status up. [ /Common/http_get11: up ] [ was down for 0hr:0min:4sec ]


Jan 5 15:16:54 TestServer notice mcpd[6300]: 01070638:5: Pool /Common/TesterHTTP_pool member /Common/WebServer:80 monitor status down. [ /Common/http_get11: down; last error: /Common/http_get11: No successful responses received before deadline. @2019/02/06 15:16:54. ] [ was up for 0hr:6mins:11sec ]

My props.conf contains the following stanza:


And my transforms.conf contains the following stanza:

REGEX = \]:\s(?P<event_code>\d+:\d):\sPool\s(?P<ltm_pool>\S+)\smember\s(?P<ltm_member>\S+)\smonitor\sstatus\s(?P<ltm_monitor_status>\S+)\.\s\[(\s\S+)+\s\]\s\[\swas\s(?P<ltm_prev_status>\S+)\sfor\s(?P<ltm_prevstatus_time>\S+)\s\]

According to regex101, this should work, since Splunk uses PCRE for regex parsing, but I haven't been able to get Splunk to parse out the fields that I'm looking for.

I tried using Web UI field extractions for this, which came up with the following regex:

^(?:[^:\n]*:){3}\s+(?P<event_code>\d+:\d+):\s+(\w+\s+)+(?P<ltm_pool>[^ ]+) member (?P<ltm_member>[^ ]+)\s+(\w+\s+)+(?P<ltm_monitor_status>[a-z]+)[^\]\n]*\]\s+\[\s+\w+\s+(?P<ltm_prev_status>\w+)\s+(\w+\s+)+(?P<ltm_prevstatus_time>[^ ]+) 

If anyone has any ideas as to why this field extraction is failing, I'd really appreciate the help.


0 Karma
1 Solution

Path Finder

I'm an idiot. This works. Just had to go into "More Fields" and select it.

View solution in original post

Path Finder

I'm an idiot. This works. Just had to go into "More Fields" and select it.

Esteemed Legend

Thanks for fessing up. It will help somebody else in the future.

Path Finder

Happens to the best of us 🙂 I always hate seeing an OP abandon a thread when they figure out a problem, without disclosing the solution, so I try to always come back when I figure something out.

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

<P style=" text-align: center; "><span class="lia-inline-image-display-wrapper lia-image-align-center" ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

<FONT size="5"><FONT size="5" color="#FF00FF">Get the latest news and updates from the Splunk Community ...