Splunk Add-on for Infoblox: extraction for DHCP events

[rpquinlan]

We often look to see if DHCP ranges are out of leases or just not configured correctly by looking for the messages that read "Peer holds all free leases" (which in Blox v8.x now reads "no permitted ranges with available leases"). However, the network that is being referenced doesn't get parsed out by the Infoblox TA app and it's a little hard to sort on.

Here's the expression for a field "network" that works for us... hope it's helpful for others.

^(?:[^:\n]*:){9}\s+\w+\s+(?P[^:]+)

[rpquinlan · Accepted solution]

Here's the expression for a field "network" that works for us... hope it's helpful for others.

^(?:[^:\n]*:){9}\s+\w+\s+(?P[^:]+)

[lfedak_splunk]

Hey @rpquinlan, Want to put your answer as an answer and accept it?

[lfedak_splunk]

I converted the comment to an answer. If you press the √Accept you'll get some Karma points. Thanks!