Getting Data In

Make Key=Value fields from _raw data during indextime

theouhuios
Motivator

Hello

I am trying to make key=value pair for the below data and I am lost on where I am going wrong..

6/26/15 10:26 AM,abcdefg.com:CRDMS,Oracle Database Server,DB Role (Oracle) Assignment report,Query Rule,Query=DB Role assignment query,"<?xml version=""1.0"" encoding=""UTF-8"" ?>
<ResultSetData>
  <Row>
    <Column name=""Server Name"">abc.abc</Column>
    <Column name=""Database Name"">CRDMS</Column>
    <Column name=""Role Name"">PCI_READ_IARD</Column>
    <Column name=""Role Grantee"">SYS</Column>
    <Column name=""Server NetBIOS Name"">abc.abc</Column>
  </Row>

What I plan to do is to make KEY=VALUE pairs for all the name’s with their corresponding values. Example.. “Server Name” = abc.abc , Database Name=CRDMS etc.

Props.conf:

[test]
TRANSFORMS-ext = ext_column_values
TRUNCATE=100000

Transforms.conf

[ext_column_values]
REGEX = ^\s+\<Column\s+name\=\"\"([^\"]+)\"\"\>([^\<]+)\<
FORMAT = $1::$2
#MV_ADD = true
#WRITE_META = true
SOURCE_KEY = _raw

But it doesn’t seem to work. Not sure where I am doing wrong. Any ideas?

0 Karma

woodcock
Esteemed Legend

It all looks good to me except that you definitely need MV_ADD=true so remove the comment character on that line, the RegEx might be better as explicitly multiline:

REGEX = (?m)^\s+\<Column\s+name\=\"\"([^\"]+)\"\"\>([^\<]+)\<
MV_ADD = true
0 Karma

theouhuios
Motivator

I tried it and it still doesn't work. Kinda strange. I am applying them on the indexer and doing a oneshot on it for now.

0 Karma

woodcock
Esteemed Legend

Is the sourcetype for the events that you would like to exploit called test? If not, you need to change your stanza header in props.conf from [test] to [yourSourceType] before it will all be connected together. Also, you may have a permission problem depending on where you have placed the props.conf and transforms.conf files. You might try setting the permissions to Global to test if this is the problem.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...