Getting Data In

Help with regex to parse the snmp inputs?

mallempati
New Member

Hi All,

Can someone help me to parse the fields either at indexing or through searches? Splunk detects the default fields as enterprises.48099.1.1.1/enterprises.48099.1.1.2 etc., . but we only need the value inside the quotations like below.

enterprises.48099.1.1.2 = STRING: "Monitoring error (SQL Server data collection)". But we need field as below:

field1 = Monitoring error (SQL Server data collection)

Sample Data:

2019-10-01 21:05:24 monspk-sqlmon-01.local [UDP: [111.12.171.01]:64274->[111.12.171.55]:162]:
DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (0) 0:00:00.00 SNMPv2-MIB::snmpTrapOID.0 = OID: SNMPv2-SMI::enterprises.48099.1.1  SNMPv2-SMI::enterprises.48099.1.1.1 = STRING: "2360689" SNMPv2-SMI::enterprises.48099.1.1.2 = STRING: "Monitoring error (SQL Server data collection)"   SNMPv2-SMI::enterprises.48099.1.1.3 = STRING: "SQL Monitor cannot collect data from the SQL Server instance."   SNMPv2-SMI::enterprises.48099.1.1.4 = STRING: "2019-10-01 19:05:00Z"    SNMPv2-SMI::enterprises.48099.1.1.5 = STRING: "Low" SNMPv2-SMI::enterprises.48099.1.1.6 = STRING: "monspk-sql8-bi01"    SNMPv2-SMI::enterprises.48099.1.1.7 = STRING: "https://monspk-sqlmon-01.local:8443/show/alert/2360689?baseMonitorId=288e5411-856f-4661-97c1-3c6cc8b5d16c"   SNMPv2-SMI::enterprises.48099.1.1.8 = STRING: "Raised"  SNMPv2-SMI::enterprises.48099.1.1.9 = ""    SNMPv2-SMI::enterprises.48099.1.1.10 = ""   SNMPv2-SMI::enterprises.48099.1.1.11 = STRING: "monspk-sql8-clust.local"    SNMPv2-SMI::enterprises.48099.1.1.12 = STRING: "monspk-SQL8-CLUST - SQL Alert"

Can someone please help with this to parse at indexing or through rex.

Thanks!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Here's one way. Since all of the strings you want to extract have no unique identifier, this rex command will pull them all into a multivalue field called 'fields'. Then you can use mvindex to access the individual fields.

... | rex max_match=0 "STRING:\s\"(?<fields>[^\"]+)" | eval field1=mvindex(fields,0), field2=mvindex(fields, 1) ...
---
If this reply helps you, Karma would be appreciated.

jacobpevans
Motivator

Hi @richgalloway,

Is there a specific reason you wouldn't use mvexpand? Just curious.

Cheers,
Jacob

Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

mvexpand gives you a different event for each value in a multi-value field. Using mvindex keeps all of the fields associated with the same event.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...