Getting Data In
Highlighted

how to sedcmd??

New Member

In the form of logs is as follows

SNMPv2-SMI::mib-"2.2.1.2.1" = "lo" SNMPv2-SMI::mib-"2.2.1.2.2" = "eth0" SNMPv2-SMI::mib-"2.2.1.2.3" = "eth1" ~~~~~

props.conf setting is as follows.

[snmptest]
sedcmd=s/SNMPv2::mib-2."2.2.1.2. ₩d+₩"//g s/" //g"
report-snmp
del=snmp_del

transforms.conf setting is as follows.
[snmp_del]
DELIMS="="
FIELDS=a1,a2,a3,........a10

I want this result.

a1="lo"
a2="eth0"
a3="eth1"

But, restart splunk this error.

Invalid key in stanza [snmp_test] in ~~/props.conf, line 123: sedcmd (value: .......)

How do you fix it?

thanks!!

Tags (3)
0 Karma
Highlighted

Re: how to sedcmd??

Contributor

Are you sure that your question is formatted correctly? Your sedcmd regex looks a little odd ...

0 Karma
Highlighted

Re: how to sedcmd??

Splunk Employee
Splunk Employee

Hi Jihoon,

Please note that SEDCMD is used only to mask or delete raw data and is configured in props.conf.

For example, if you want to hide the first 5 digits of an account number in the vendor_sales.log source:

[22/Oct/2014:00:46:27] VendorID=9112 Code=B AcctID=4902636948
[22/Oct/2014:00:48:40] VendorID=1004 Code=J AcctID=4236256056
[22/Oct/2014:00:50:02] VendorID=5034 Code=H AcctID=8462999288

You configure the following in props.conf:
[source::.../vendor_sales.log]
SEDCMD-1acct = s/AcctID=\d{5}(\d{5})/AcctID=xxxxx\1/g

SEDCMD provides "search and replace" using regular expressions and substitutions and in the example, \1 indicates the captured group.

Hope this helps. Thanks!
Hunter Shen

0 Karma
Highlighted

Re: how to sedcmd??

SplunkTrust
SplunkTrust

Your regex string doesn't match the data. Try

sedcmd=s/SNMPv2-SMI::mib-"2\.2\.1\.2\.\d+"//g
---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: how to sedcmd??

Esteemed Legend

The problem is that SEDCMD and REPORT must be in ALL-CAPS.
Another problem is that SEDCMD must have a unique (but arbitrary) suffix, like this: SEDCMD-arbitraryname =

0 Karma