I have a sourcetype which contains raw SNMP data which looks like this (port definitions for network switches):
timestamp=1661975375 IF-MIB::ifAlias.1 = "ServerA Port 1"
timestamp=1661975375 IF-MIB::ifDescr.1 = "Unit: 1 Slot: 0 Port: 1 Gigabit - Level"
timestamp=1661975375 IF-MIB::ifAlias.53 = "ServerA Port 2"
timestamp=1661975375 IF-MIB::ifDescr.53 = "Unit: 2 Slot: 0 Port: 1 Gigabit - Level"
timestamp=1661971775 IF-MIB::ifAlias.626 = "ServerA LAG"
timestamp=1661971775 IF-MIB::ifDescr.626 = " Link Aggregate 1"
I want to generate fields when this data is ingested into Splunk. I do not want to do this during search. (So probably using transforms.conf and regex). I think there’s ways to do this with Python as well, but I don’t have the experience or time to go down that path.
The result of the above 6 rows of example data would have the following fields for each line respectively:
Alias=1, Description=”ServerA Port 1”
Alias=1, Unit=1, Port=1
Alias=53, Description=”ServerA Port 2”
Alias=53, Unit=2, Port=1
Alias=626, Description=”ServerA LAG”
Alias=626, Lag=1
I can build field extractions or a manual regex to do one of these lines individually, but not all together. I also wonder if pure regex is the way to go here as it seems like it would take many "steps" with this many parameters.
Would really appreciate the help from someone with the knowledge and experience of using transforms to get this done. 🙂
Thank you in advance for solutions or recommendations.
