Knowledge Management

Cisco ice parse fields problem

Dmitriy
Explorer

Hello!
We have index with cisco events and now we need to parse some fields such as device_mac and device_name. But we can't do it by regex because we get unstructured data from cisco (fields are swapped).

For example in this log first there is device type, and after mac

Dmitriy_1-1628683456038.png

And the next one comes first mac, and after device type

Dmitriy_2-1628683478592.png

Could you please help me? How i can parse this fields?

Thanks!

Labels (1)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Use two rex commands

| rex "device-type=(?<devicetype>[^,]+)"
| rex "device-mac=(?<devicemac>[^,]+)"

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Unless I'm missing something, the fields are labeled so parsing is trivial.  KV_MODE=auto should do it at index-time.  Or use a separate EXTRACT statement in props.conf for each field.  Or use a separate rex command for each field in SPL.

---
If this reply helps you, Karma would be appreciated.
0 Karma

Dmitriy
Explorer

Could you please give extract syntax to add device-type and device-mac to props.conf

0 Karma

richgalloway
SplunkTrust
SplunkTrust
EXTRACT-mac = device-mac=(?<deviceMac>[^,]+)
EXTRACT-type = device-type=(?<deviceType>[^,]+)
---
If this reply helps you, Karma would be appreciated.

ITWhisperer
SplunkTrust
SplunkTrust

Use two rex commands

| rex "device-type=(?<devicetype>[^,]+)"
| rex "device-mac=(?<devicemac>[^,]+)"

Dmitriy
Explorer

Could you please explane wrehe i need to use this command?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

In your SPL search query.

0 Karma

Dmitriy
Explorer

Can I use this command in source type? Or maybe another command

0 Karma

Dmitriy
Explorer

Thanks!

But i have one more question

How i can save this fields to not in search rex commands?  I mean how to auto extract this to fields witout rex commad.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...