Knowledge Management

Cisco ice parse fields problem

Dmitriy
Explorer

Hello!
We have index with cisco events and now we need to parse some fields such as device_mac and device_name. But we can't do it by regex because we get unstructured data from cisco (fields are swapped).

For example in this log first there is device type, and after mac

Dmitriy_1-1628683456038.png

And the next one comes first mac, and after device type

Dmitriy_2-1628683478592.png

Could you please help me? How i can parse this fields?

Thanks!

Labels (1)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Use two rex commands

| rex "device-type=(?<devicetype>[^,]+)"
| rex "device-mac=(?<devicemac>[^,]+)"

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Unless I'm missing something, the fields are labeled so parsing is trivial.  KV_MODE=auto should do it at index-time.  Or use a separate EXTRACT statement in props.conf for each field.  Or use a separate rex command for each field in SPL.

---
If this reply helps you, Karma would be appreciated.
0 Karma

Dmitriy
Explorer

Could you please give extract syntax to add device-type and device-mac to props.conf

0 Karma

richgalloway
SplunkTrust
SplunkTrust
EXTRACT-mac = device-mac=(?<deviceMac>[^,]+)
EXTRACT-type = device-type=(?<deviceType>[^,]+)
---
If this reply helps you, Karma would be appreciated.

ITWhisperer
SplunkTrust
SplunkTrust

Use two rex commands

| rex "device-type=(?<devicetype>[^,]+)"
| rex "device-mac=(?<devicemac>[^,]+)"

Dmitriy
Explorer

Could you please explane wrehe i need to use this command?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

In your SPL search query.

0 Karma

Dmitriy
Explorer

Can I use this command in source type? Or maybe another command

0 Karma

Dmitriy
Explorer

Thanks!

But i have one more question

How i can save this fields to not in search rex commands?  I mean how to auto extract this to fields witout rex commad.

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...