parse snmp result

[ragkna]

Hello Experts,

I'm using snmp-modular--input app to get my device stats using multiple object ids (get next, not bulk). The result is shown below.

timestamp1 SNMPv2-SMI::enterprises."14685.3.1.5.1.0" = "48" SNMPv2-SMI::enterprises."14685.3.1.52.2.0" = "1" SNMPv2-SMI::enterprises."14685.3.1.52.3.0" = "14"

I have problem in splitting above result like this:-
timestamp1 SNMPv2-SMI::enterprises."14685.3.1.5.1.0" = "48"

timestamp1 SNMPv2-SMI::enterprises."14685.3.1.52.2.0" = "1"

timestamp1 SNMPv2-SMI::enterprises."14685.3.1.52.3.0" = "14"

I can then make use of rex expressions to get "14685.3.1.5.1.0" as field1 and "48" as field2 and use this as a name-value pair for dashboards.

Could someone please tell me how to split? or any other approach?

[ragkna]

Can someone pl give insight on this problem?

[ragkna]

Ayn- Please check below comment..

[ragkna]

I have below rex expression which extract fields from above event.

• source=snmp |eval _raw = split(_raw, "SNMPv2-SMI::enterprises.") | mvexpand _raw|rex "[^\"\n]*\"(?P[^\"]+)\"(?P[^\"]+)\"(?P[^\"]+)"

Result of above query idexed to:
FIELDNAME1=14685.3.1.5.1.0, 14685.3.1.52.2.0 and 14685.3.1.52.3.0
FIELDNAME2= '=' (Assigned to 'equal to')
FIELDNAME3= 48,1, and 14

Now, I'm unable to correlate between FIELDNAME1 and FIELDNAME3, which I need as name-value pair. If I split this into multiple and extract then resulted index holds FIELDNAME1='14685.3.1.5.1.0' and FIELDNAME3='48'. I do not need to correlate in this case.
Please let me know If you can give better idea.

[Ayn]

I don't entirely follow why you need to split this into separate events? You're not limited to one extraction per event so you can just add all those extractions and have them apply to one single event instead.