Hello,
I'm currently working with F5 BigIP logs and attempting to extract peer status from the f5:bigip:syslog sourcetype.
examples of the 2 types of log I'm interested in:
Jan 5 13:10:58 TestServer notice mcpd[6300]: 01070727:5: Pool /Common/TesterHTTP_pool member /Common/WebServer:80 monitor status up. [ /Common/http_get11: up ] [ was down for 0hr:0min:4sec ]
.
Jan 5 15:16:54 TestServer notice mcpd[6300]: 01070638:5: Pool /Common/TesterHTTP_pool member /Common/WebServer:80 monitor status down. [ /Common/http_get11: down; last error: /Common/http_get11: No successful responses received before deadline. @2019/02/06 15:16:54. ] [ was up for 0hr:6mins:11sec ]
My props.conf contains the following stanza:
[f5:bigip:syslog]
TRANSFORMS-Status=PoolMemberStatus
And my transforms.conf contains the following stanza:
[PoolMemberStatus]
REGEX = \]:\s(?P<event_code>\d+:\d):\sPool\s(?P<ltm_pool>\S+)\smember\s(?P<ltm_member>\S+)\smonitor\sstatus\s(?P<ltm_monitor_status>\S+)\.\s\[(\s\S+)+\s\]\s\[\swas\s(?P<ltm_prev_status>\S+)\sfor\s(?P<ltm_prevstatus_time>\S+)\s\]
According to regex101, this should work, since Splunk uses PCRE for regex parsing, but I haven't been able to get Splunk to parse out the fields that I'm looking for.
I tried using Web UI field extractions for this, which came up with the following regex:
^(?:[^:\n]*:){3}\s+(?P<event_code>\d+:\d+):\s+(\w+\s+)+(?P<ltm_pool>[^ ]+) member (?P<ltm_member>[^ ]+)\s+(\w+\s+)+(?P<ltm_monitor_status>[a-z]+)[^\]\n]*\]\s+\[\s+\w+\s+(?P<ltm_prev_status>\w+)\s+(\w+\s+)+(?P<ltm_prevstatus_time>[^ ]+)
If anyone has any ideas as to why this field extraction is failing, I'd really appreciate the help.
Thanks
I'm an idiot. This works. Just had to go into "More Fields" and select it.
I'm an idiot. This works. Just had to go into "More Fields" and select it.
Thanks for fessing up. It will help somebody else in the future.
Happens to the best of us 🙂 I always hate seeing an OP abandon a thread when they figure out a problem, without disclosing the solution, so I try to always come back when I figure something out.