I would like to split a field called "destination" and "original_source" into 2 fields, each is an ip:port or [ipv6]:port
ex 1.2.3.4:443
[ff:33::434:sdfsf]:443
here is what i currently have to do this:
transforms.conf:
[src_translated_tran]
SOURCE_KEY = original_src
DELIMS = ":"
FIELDS = src_translated_ip, src_translated_port
[destination_tran]
SOURCE_KEY = destination
DELIMS = ":"
FIELDS = dest, dest_port
props.conf
[isafwsw3c]
REPORT-src_translated = src_translated_tran
REPORT-destination_tran = destination_tran
These are not working, any help would be appreciated.
These worked for me. I created these from UI (my system takes ages to restart splunk). In case you don't see the fields, try with adding "|extract reload=t" in the search to reload the field extraction configuration.
transforms.conf.
[destination_tran]
FORMAT = dest::$1 dest_port::$2
REGEX = ([\w|\d]+\.[\w|\d]+\.[\w|\d]+\.[\w|\d]+):(\d+)
SOURCE_KEY = destination
[src_translated_tran]
FORMAT = src_translated_ip::$1 src_translated_port::$2
REGEX = (\[[\w|\d]+\.[\w|\d]+\.[\w|\d]+\.[\w|\d]+\]):(\d+)
SOURCE_KEY = destination
These worked for me. I created these from UI (my system takes ages to restart splunk). In case you don't see the fields, try with adding "|extract reload=t" in the search to reload the field extraction configuration.
transforms.conf.
[destination_tran]
FORMAT = dest::$1 dest_port::$2
REGEX = ([\w|\d]+\.[\w|\d]+\.[\w|\d]+\.[\w|\d]+):(\d+)
SOURCE_KEY = destination
[src_translated_tran]
FORMAT = src_translated_ip::$1 src_translated_port::$2
REGEX = (\[[\w|\d]+\.[\w|\d]+\.[\w|\d]+\.[\w|\d]+\]):(\d+)
SOURCE_KEY = destination
I just realized its happening for me too. I tried restart/refresh but same behavior (shows only after explicit "|extract reload=t").
Strange, dest only shows up when I have |extract reload=t on the end of the search
Thanks!, the |extract reload=t did the trick. Strange how my restart of splunk did not reload the extracts.