This goes on for awhile and is all on a single line.
My props.conf looks like this:
Now, the SEDCMD works appropriately and puts each event on it's own line, but the LINE_BREAKER doesn't do anything. Oddly, if I paste the original event data into a text file and build the same configuration for it, it works fine.
Additionally, I can't figure out how to extract the fields. After my SEDCMD, the data looks like this:
I've tinkered with SEDCMD and can get it to look nicer, but after an entire day of messing with the field extractions, transforms, delims, fields etc. I haven't gotten it to break those lines into fields. Any help would be greatly appreciated.
If I understand correctly you require a very customized output , so you are right, responsehandlers.py exists for this purpose.
If you look at responsehandlers.py , there is an example custom response handler called "JSONFormatterResponseHandler" that converts SNMP attribute output into JSON. So you could go off this as a guideline for your custom response handler. You then declare this custom response handler name in your SNMP stanza setup and it will get applied.