All Apps and Add-ons

I'm having some trouble with creating a field extraction using Regex

Path Finder


I'm currently working with F5 BigIP logs and attempting to extract peer status from the f5:bigip:syslog sourcetype.

examples of the 2 types of log I'm interested in:

Jan 5 13:10:58 TestServer notice mcpd[6300]: 01070727:5: Pool /Common/TesterHTTP_pool member /Common/WebServer:80 monitor status up. [ /Common/http_get11: up ] [ was down for 0hr:0min:4sec ]


Jan 5 15:16:54 TestServer notice mcpd[6300]: 01070638:5: Pool /Common/TesterHTTP_pool member /Common/WebServer:80 monitor status down. [ /Common/http_get11: down; last error: /Common/http_get11: No successful responses received before deadline. @2019/02/06 15:16:54. ] [ was up for 0hr:6mins:11sec ]

My props.conf contains the following stanza:


And my transforms.conf contains the following stanza:

REGEX = \]:\s(?P<event_code>\d+:\d):\sPool\s(?P<ltm_pool>\S+)\smember\s(?P<ltm_member>\S+)\smonitor\sstatus\s(?P<ltm_monitor_status>\S+)\.\s\[(\s\S+)+\s\]\s\[\swas\s(?P<ltm_prev_status>\S+)\sfor\s(?P<ltm_prevstatus_time>\S+)\s\]

According to regex101, this should work, since Splunk uses PCRE for regex parsing, but I haven't been able to get Splunk to parse out the fields that I'm looking for.

I tried using Web UI field extractions for this, which came up with the following regex:

^(?:[^:\n]*:){3}\s+(?P<event_code>\d+:\d+):\s+(\w+\s+)+(?P<ltm_pool>[^ ]+) member (?P<ltm_member>[^ ]+)\s+(\w+\s+)+(?P<ltm_monitor_status>[a-z]+)[^\]\n]*\]\s+\[\s+\w+\s+(?P<ltm_prev_status>\w+)\s+(\w+\s+)+(?P<ltm_prevstatus_time>[^ ]+) 

If anyone has any ideas as to why this field extraction is failing, I'd really appreciate the help.


0 Karma
1 Solution

Path Finder

I'm an idiot. This works. Just had to go into "More Fields" and select it.

View solution in original post

Path Finder

I'm an idiot. This works. Just had to go into "More Fields" and select it.

Esteemed Legend

Thanks for fessing up. It will help somebody else in the future.

Path Finder

Happens to the best of us 🙂 I always hate seeing an OP abandon a thread when they figure out a problem, without disclosing the solution, so I try to always come back when I figure something out.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...