All Apps and Add-ons

Linux DHCP new regex,New dhcp log format

nocsolcon
Explorer

We've upgraded our DHCP server to debian 9. Now the dhcp log is written differently then on our old server
log lines contains now: dhcpd[1569]: instead of dhcpd:

Jul 18 09:12:43 dhcp-server-name dhcpd[1569]: DHCPACK on ip-address to 00:00:00:00:00:00 (modem-type) via ip-address

the app: Linux DHCP can not handle this

can we change the regex in transform.conf

from:
\s(dhcpd):\s

to:
\sdhcpd(:\s|[\d+]:\s)

or should we change more? I tested it, but this change to transform.conf does not work

0 Karma

FrankVl
Ultra Champion

Try escaping those [ ] characters. They have special meaning in regular expressions, so if you want to match actual brackets, they need to be escaped: \sdhcpd(\:\s|\[\d+\]\:\s) https://regex101.com/r/pRwz3z/1

nocsolcon
Explorer

I've fixed it by changing all the regex in the transforms.conf

from:

\s(dhcpd)\:\s

to:

 \sdhcpd(\:\s|\[\d+\]:\s)

Also we need to change the file: eventtypes.conf

from:

[dhcpd_event]
search = process=dhcpd

to:

[dhcpd_event]
search = dhcpd

After this, it is working for the old and new log lines

0 Karma

FrankVl
Ultra Champion

Why the double backslashes?

0 Karma

nocsolcon
Explorer

Sorry, my mistake. I changed it.

0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...