Getting Data In

transforms.conf multiple $1 assignments

Splunker
Communicator

Folks,

Running Splunk v4.3 and trying to understand this phenomenon. In transforms.conf, something like this:

[transport]
REGEX = (TCP|tcp|UDP|udp|ICMP|icmp)
FORMAT = transport::$1 protocol::$1

Seems to only create the latter field (protocol), transport doesn't seem to exist. Is there any way i can make Splunk create both fields?

Thanks.

Tags (1)
0 Karma
1 Solution

RicoSuave
Builder

This is really going to depend on which fields show up first in your event. I'm going to assume that transport shows up first followed by protocol. The reason your current configuration isn't working is because you need to setup grouping in your regex. Try doing this instead.

[transport]
REGEX = (TCP|tcp|UDP|udp|ICMP|icmp)|(TCP|tcp|UDP|udp|ICMP|icmp)
FORMAT = transport::$1 protocol::$2

Let me know if this works.

View solution in original post

RicoSuave
Builder

This is really going to depend on which fields show up first in your event. I'm going to assume that transport shows up first followed by protocol. The reason your current configuration isn't working is because you need to setup grouping in your regex. Try doing this instead.

[transport]
REGEX = (TCP|tcp|UDP|udp|ICMP|icmp)|(TCP|tcp|UDP|udp|ICMP|icmp)
FORMAT = transport::$1 protocol::$2

Let me know if this works.

Splunker
Communicator

Hey Joetron,

That should technically work for single-captures, but i realised multi-captures would get much more difficult. I opted to make the duplicate captures field-aliases instead.

So transport::$1 but protocol is an alias to transport.

The above was defined in an app on SplunkBase, which made me wonder if there was a way to do this, but now i think it's just a bug.. Will award you the points as your answer is correct 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...