All Apps and Add-ons

Splunk Add-on for Infoblox: extraction for DHCP events

rpquinlan
Path Finder

We often look to see if DHCP ranges are out of leases or just not configured correctly by looking for the messages that read "Peer holds all free leases" (which in Blox v8.x now reads "no permitted ranges with available leases"). However, the network that is being referenced doesn't get parsed out by the Infoblox TA app and it's a little hard to sort on.

Here's the expression for a field "network" that works for us... hope it's helpful for others.

^(?:[^:\n]*:){9}\s+\w+\s+(?P[^:]+)

0 Karma
1 Solution

rpquinlan
Path Finder

Here's the expression for a field "network" that works for us... hope it's helpful for others.

^(?:[^:\n]*:){9}\s+\w+\s+(?P[^:]+)

View solution in original post

rpquinlan
Path Finder

Here's the expression for a field "network" that works for us... hope it's helpful for others.

^(?:[^:\n]*:){9}\s+\w+\s+(?P[^:]+)

lfedak_splunk
Splunk Employee
Splunk Employee

Hey @rpquinlan, Want to put your answer as an answer and accept it?

0 Karma

lfedak_splunk
Splunk Employee
Splunk Employee

I converted the comment to an answer. If you press the √Accept you'll get some Karma points. Thanks!

Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...