Getting Data In

Dynamic SNMP OID - Convert ASCII number to Text Value

mannioke
Engager

Let me start by admitting there are likely a half dozen better ways to ingest the data but I don't have access to change that, thus I must learn how to manipulate what I have.

Goal: Take a dynamic set of ASCII numbers delimited by a "." and convert that to letters or punctuation and remove the delimiter.

Issue: I can isolate the sequence but have yet to find a method to convert the decimal number to ASCII character. My best lead thus far is find a way to convert the number to base16 and then use the SPLUNK function for URL decode.

SCENERIO

If you are familiar with the MIB from JUNOS for jnxJSNatSrcNumSessions you are aware of the OID value is part standard and part dynamic based on the POOL NAME and IP structure. Structured as such "1.3.6.1.4.2636.3.39.1.7.1.1.4.1.6.<#i>.<#x>.<#y>.<#z>.0.192.168.0.0".

Fictionalized Data from _raw

SNMPv2-SMI::enterprises."2636.3.39.1.7.1.1.4.1.6.1.120.121.122.0.192.168.0.0" = "100"
SNMPv2-SMI::enterprises."2636.3.39.1.7.1.1.4.1.6.1.120.121.122.0.192.168.0.1" = "95"
SNMPv2-SMI::enterprises."2636.3.39.1.7.1.1.4.1.6.2.97.98.45.99.0.10.0.0.1" = "1250"
SNMPv2-SMI::enterprises."2636.3.39.1.7.1.1.4.1.6.2.97.98.45.99.0.10.0.0.2" = "1000"

What I want is to be able to pull a table like the following:
Pool-num, Pool-name, Pool-ip, Sessions
1, xyz, 192.168.0.0, 100
1, xyz, 192.168.0.1, 95
2, ab-c, 10.0.0.1, 1250
2, ab-c, 10.0.0.2, 1000

Any suggestions on how to take the isolated portion of the OID and convert each to a HEX value and then run URL decode? or is there a simpler way to accomplish what I want?

0 Karma

to4kawa
Ultra Champion
| makeresults
| eval _raw="SNMPv2-SMI::enterprises \"2636.3.39.1.7.1.1.4.1.6.1.120.121.122.0.192.168.0.0\" = \"100\"
    SNMPv2-SMI::enterprises.\"2636.3.39.1.7.1.1.4.1.6.1.120.121.122.0.192.168.0.1\" = \"95\"
    SNMPv2-SMI::enterprises.\"2636.3.39.1.7.1.1.4.1.6.2.97.98.45.99.0.10.0.0.1\" = \"1250\"
    SNMPv2-SMI::enterprises.\"2636.3.39.1.7.1.1.4.1.6.2.97.98.45.99.0.10.0.0.2\" = \"1000\""
| makemv delim="
" _raw
| stats count by _raw
| rex "\"2636\.3\.39\.1\.7\.1\.1\.4\.1\.6\.(?<Pool_num>\d+)\.(?<Pool_name>[\d\.]+)\.(?<Pool_ip>\d+\.\d+\.\d+\.\d)(?:\"\s=\s\")(?<Sessions>\d+)\""
| eval Pool_name=split(Pool_name,".")
| mvexpand Pool_name
| eval decode_pool=printf("%c",Pool_name)
| stats list(decode_pool) as Pool_name by _raw Pool_ip Pool_num Sessions
| eval Pool_name=mvjoin(Pool_name,"")
| table Pool_num Pool_ip Pool_name Sessions
| sort Pool_num Pool_ip

Convert ASCII code to strings is useful using printf("%c")

but I don't know the opposite.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...