transforms.conf multiple $1 assignments

[Splunker]

Folks,

Running Splunk v4.3 and trying to understand this phenomenon. In transforms.conf, something like this:

[transport]
REGEX = (TCP|tcp|UDP|udp|ICMP|icmp)
FORMAT = transport::$1 protocol::$1

Seems to only create the latter field (protocol), transport doesn't seem to exist. Is there any way i can make Splunk create both fields?

Thanks.

[RicoSuave · Accepted solution]

This is really going to depend on which fields show up first in your event. I'm going to assume that transport shows up first followed by protocol. The reason your current configuration isn't working is because you need to setup grouping in your regex. Try doing this instead.

[transport]
REGEX = (TCP|tcp|UDP|udp|ICMP|icmp)|(TCP|tcp|UDP|udp|ICMP|icmp)
FORMAT = transport::$1 protocol::$2

Let me know if this works.

[Splunker]

Hey Joetron,

That should technically work for single-captures, but i realised multi-captures would get much more difficult. I opted to make the duplicate captures field-aliases instead.

So transport::$1 but protocol is an alias to transport.

The above was defined in an app on SplunkBase, which made me wonder if there was a way to do this, but now i think it's just a bug.. Will award you the points as your answer is correct 🙂