I'm having some trouble with creating a field extraction using Regex

[janderson19]

Hello,

I'm currently working with F5 BigIP logs and attempting to extract peer status from the f5:bigip:syslog sourcetype.

examples of the 2 types of log I'm interested in:

Jan 5 13:10:58 TestServer notice mcpd[6300]: 01070727:5: Pool /Common/TesterHTTP_pool member /Common/WebServer:80 monitor status up. [ /Common/http_get11: up ] [ was down for 0hr:0min:4sec ]

.

Jan 5 15:16:54 TestServer notice mcpd[6300]: 01070638:5: Pool /Common/TesterHTTP_pool member /Common/WebServer:80 monitor status down. [ /Common/http_get11: down; last error: /Common/http_get11: No successful responses received before deadline. @2019/02/06 15:16:54. ] [ was up for 0hr:6mins:11sec ]

My props.conf contains the following stanza:

[f5:bigip:syslog]
TRANSFORMS-Status=PoolMemberStatus

And my transforms.conf contains the following stanza:

[PoolMemberStatus]
REGEX = \]:\s(?P<event_code>\d+:\d):\sPool\s(?P<ltm_pool>\S+)\smember\s(?P<ltm_member>\S+)\smonitor\sstatus\s(?P<ltm_monitor_status>\S+)\.\s\[(\s\S+)+\s\]\s\[\swas\s(?P<ltm_prev_status>\S+)\sfor\s(?P<ltm_prevstatus_time>\S+)\s\]

According to regex101, this should work, since Splunk uses PCRE for regex parsing, but I haven't been able to get Splunk to parse out the fields that I'm looking for.

I tried using Web UI field extractions for this, which came up with the following regex:

^(?:[^:\n]*:){3}\s+(?P<event_code>\d+:\d+):\s+(\w+\s+)+(?P<ltm_pool>[^ ]+) member (?P<ltm_member>[^ ]+)\s+(\w+\s+)+(?P<ltm_monitor_status>[a-z]+)[^\]\n]*\]\s+\[\s+\w+\s+(?P<ltm_prev_status>\w+)\s+(\w+\s+)+(?P<ltm_prevstatus_time>[^ ]+) 

If anyone has any ideas as to why this field extraction is failing, I'd really appreciate the help.

Thanks

[janderson19 · Accepted solution]

I'm an idiot. This works. Just had to go into "More Fields" and select it.

[woodcock]

Thanks for fessing up. It will help somebody else in the future.

[janderson19]

Happens to the best of us 🙂 I always hate seeing an OP abandon a thread when they figure out a problem, without disclosing the solution, so I try to always come back when I figure something out.