Getting Data In

Help with regex to parse the snmp inputs?

mallempati
New Member

Hi All,

Can someone help me to parse the fields either at indexing or through searches? Splunk detects the default fields as enterprises.48099.1.1.1/enterprises.48099.1.1.2 etc., . but we only need the value inside the quotations like below.

enterprises.48099.1.1.2 = STRING: "Monitoring error (SQL Server data collection)". But we need field as below:

field1 = Monitoring error (SQL Server data collection)

Sample Data:

2019-10-01 21:05:24 monspk-sqlmon-01.local [UDP: [111.12.171.01]:64274->[111.12.171.55]:162]:
DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (0) 0:00:00.00 SNMPv2-MIB::snmpTrapOID.0 = OID: SNMPv2-SMI::enterprises.48099.1.1  SNMPv2-SMI::enterprises.48099.1.1.1 = STRING: "2360689" SNMPv2-SMI::enterprises.48099.1.1.2 = STRING: "Monitoring error (SQL Server data collection)"   SNMPv2-SMI::enterprises.48099.1.1.3 = STRING: "SQL Monitor cannot collect data from the SQL Server instance."   SNMPv2-SMI::enterprises.48099.1.1.4 = STRING: "2019-10-01 19:05:00Z"    SNMPv2-SMI::enterprises.48099.1.1.5 = STRING: "Low" SNMPv2-SMI::enterprises.48099.1.1.6 = STRING: "monspk-sql8-bi01"    SNMPv2-SMI::enterprises.48099.1.1.7 = STRING: "https://monspk-sqlmon-01.local:8443/show/alert/2360689?baseMonitorId=288e5411-856f-4661-97c1-3c6cc8b5d16c"   SNMPv2-SMI::enterprises.48099.1.1.8 = STRING: "Raised"  SNMPv2-SMI::enterprises.48099.1.1.9 = ""    SNMPv2-SMI::enterprises.48099.1.1.10 = ""   SNMPv2-SMI::enterprises.48099.1.1.11 = STRING: "monspk-sql8-clust.local"    SNMPv2-SMI::enterprises.48099.1.1.12 = STRING: "monspk-SQL8-CLUST - SQL Alert"

Can someone please help with this to parse at indexing or through rex.

Thanks!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Here's one way. Since all of the strings you want to extract have no unique identifier, this rex command will pull them all into a multivalue field called 'fields'. Then you can use mvindex to access the individual fields.

... | rex max_match=0 "STRING:\s\"(?<fields>[^\"]+)" | eval field1=mvindex(fields,0), field2=mvindex(fields, 1) ...
---
If this reply helps you, an upvote would be appreciated.

jacobpevans
Motivator

Hi @richgalloway,

Is there a specific reason you wouldn't use mvexpand? Just curious.

Cheers,
Jacob

Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

mvexpand gives you a different event for each value in a multi-value field. Using mvindex keeps all of the fields associated with the same event.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Tune In & Win!

Don't miss out on your
chance to take home free
prizes by helping our players
save the Splunk Cloudom!

Dungeons & Data
Monsters: Splunk O11y
Day Editions Games
stream live:
5/4 at 6:30pm PST
5/5 at 7:00pm PST
on