Getting Data In
Highlighted

Help with regex to parse the snmp inputs?

New Member

Hi All,

Can someone help me to parse the fields either at indexing or through searches? Splunk detects the default fields as enterprises.48099.1.1.1/enterprises.48099.1.1.2 etc., . but we only need the value inside the quotations like below.

enterprises.48099.1.1.2 = STRING: "Monitoring error (SQL Server data collection)". But we need field as below:

field1 = Monitoring error (SQL Server data collection)

Sample Data:

2019-10-01 21:05:24 monspk-sqlmon-01.local [UDP: [111.12.171.01]:64274->[111.12.171.55]:162]:
DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (0) 0:00:00.00 SNMPv2-MIB::snmpTrapOID.0 = OID: SNMPv2-SMI::enterprises.48099.1.1  SNMPv2-SMI::enterprises.48099.1.1.1 = STRING: "2360689" SNMPv2-SMI::enterprises.48099.1.1.2 = STRING: "Monitoring error (SQL Server data collection)"   SNMPv2-SMI::enterprises.48099.1.1.3 = STRING: "SQL Monitor cannot collect data from the SQL Server instance."   SNMPv2-SMI::enterprises.48099.1.1.4 = STRING: "2019-10-01 19:05:00Z"    SNMPv2-SMI::enterprises.48099.1.1.5 = STRING: "Low" SNMPv2-SMI::enterprises.48099.1.1.6 = STRING: "monspk-sql8-bi01"    SNMPv2-SMI::enterprises.48099.1.1.7 = STRING: "https://monspk-sqlmon-01.local:8443/show/alert/2360689?baseMonitorId=288e5411-856f-4661-97c1-3c6cc8b5d16c"   SNMPv2-SMI::enterprises.48099.1.1.8 = STRING: "Raised"  SNMPv2-SMI::enterprises.48099.1.1.9 = ""    SNMPv2-SMI::enterprises.48099.1.1.10 = ""   SNMPv2-SMI::enterprises.48099.1.1.11 = STRING: "monspk-sql8-clust.local"    SNMPv2-SMI::enterprises.48099.1.1.12 = STRING: "monspk-SQL8-CLUST - SQL Alert"

Can someone please help with this to parse at indexing or through rex.

Thanks!

0 Karma
Highlighted

Re: Help with regex to parse the snmp inputs?

SplunkTrust
SplunkTrust

Here's one way. Since all of the strings you want to extract have no unique identifier, this rex command will pull them all into a multivalue field called 'fields'. Then you can use mvindex to access the individual fields.

... | rex max_match=0 "STRING:\s\"(?<fields>[^\"]+)" | eval field1=mvindex(fields,0), field2=mvindex(fields, 1) ...
---
If this reply helps you, an upvote would be appreciated.
Highlighted

Re: Help with regex to parse the snmp inputs?

Motivator

Hi @richgalloway,

Is there a specific reason you wouldn't use mvexpand? Just curious.

Cheers,
Jacob

Cheers,
Jacob
0 Karma
Highlighted

Re: Help with regex to parse the snmp inputs?

SplunkTrust
SplunkTrust

mvexpand gives you a different event for each value in a multi-value field. Using mvindex keeps all of the fields associated with the same event.

---
If this reply helps you, an upvote would be appreciated.
0 Karma