Getting Data In

transforms.conf multiple $1 assignments

Splunker
Communicator

Folks,

Running Splunk v4.3 and trying to understand this phenomenon. In transforms.conf, something like this:

[transport]
REGEX = (TCP|tcp|UDP|udp|ICMP|icmp)
FORMAT = transport::$1 protocol::$1

Seems to only create the latter field (protocol), transport doesn't seem to exist. Is there any way i can make Splunk create both fields?

Thanks.

Tags (1)
0 Karma
1 Solution

RicoSuave
Builder

This is really going to depend on which fields show up first in your event. I'm going to assume that transport shows up first followed by protocol. The reason your current configuration isn't working is because you need to setup grouping in your regex. Try doing this instead.

[transport]
REGEX = (TCP|tcp|UDP|udp|ICMP|icmp)|(TCP|tcp|UDP|udp|ICMP|icmp)
FORMAT = transport::$1 protocol::$2

Let me know if this works.

View solution in original post

RicoSuave
Builder

This is really going to depend on which fields show up first in your event. I'm going to assume that transport shows up first followed by protocol. The reason your current configuration isn't working is because you need to setup grouping in your regex. Try doing this instead.

[transport]
REGEX = (TCP|tcp|UDP|udp|ICMP|icmp)|(TCP|tcp|UDP|udp|ICMP|icmp)
FORMAT = transport::$1 protocol::$2

Let me know if this works.

Splunker
Communicator

Hey Joetron,

That should technically work for single-captures, but i realised multi-captures would get much more difficult. I opted to make the duplicate captures field-aliases instead.

So transport::$1 but protocol is an alias to transport.

The above was defined in an app on SplunkBase, which made me wonder if there was a way to do this, but now i think it's just a bug.. Will award you the points as your answer is correct 🙂

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...