Getting Data In

Prop Config Issue

Jiamin
New Member

Hi, I currently writing prop configure to validate my event

Events

Feb 03 13:22:23 Jessica-Ubuntu kernel: [ 7098.424722] usb 1-1: Manufacturer: SanDisk Feb 3 13:22:23 Jessica-Ubuntu kernel: [ 7098.424725] usb 1-1: SerialNumber: 200522427013E6812147 Feb 4 22:11:46 Jessica-Ubuntu kernel: [ 2.710593] usb 2-2.1: Product: Virtual Bluetooth Adapter Feb 4 22:11:46 Jessica-Ubuntu kernel: [ 2.710597] usb 2-2.1: SerialNumber: 000650268328

PropConfig Settings

[source::linuxusb]
SHOULD_LINEMERGE = true
BREAK_ONLY_BEFORE = Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec
EXTRACT-date = (?i) .*? (?P\w+\s+\d+\s+\d+:\d+:\d+)\s+\w+
EXTRACT-description = (?i) Product: (?P.+?)\s+\w+\s+\d+
EXTRACT-device_mfg = (?i) Manufacturer: (?P[^ ]+)
EXTRACT-serial_number = (?i) SerialNumber: (?P.+)

Result for SerialNumber

200522427013E6812147 Feb 4 22:11:46 Jessica-Ubuntu kernel: [ 2.710593] usb 2-2.1: Product: Virtual Bluetooth Adapter Feb 4 22:11:46 Jessica-Ubuntu kernel: [ 2.710597] usb 2-2.1: SerialNumber: 000650268328

I only wan 200522427013E6812147. How do i grab this data only. Please help

Tags (1)
0 Karma

Jiamin
New Member

Thanks for the help! i solved this problem by using:
EXTRACT-serial_number = (?i) SerialNumber: (?P.[^ ]+)

0 Karma

kristian_kolb
Ultra Champion

Is this one, or four events? If it's supposed to be four events, then your line-breaking isn't working either.

For the REGEX extraction of SerialNumber, just be a bit more specific - instead of .+ try \S+ (i.e. anything but newline, tab, space) or even [A-Z0-9]+ depending on what characters you can expect to find.

/K

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...