Splunk Enterprise

Should I use Custom transform or RegEx for my search?

bharrell
Path Finder

I have a sourcetype which contains raw SNMP data which looks like this (port definitions for network switches):

timestamp=1661975375 IF-MIB::ifAlias.1 = "ServerA Port 1" 

timestamp=1661975375 IF-MIB::ifDescr.1 = "Unit: 1 Slot: 0 Port: 1 Gigabit - Level" 

timestamp=1661975375 IF-MIB::ifAlias.53 = "ServerA Port 2" 

timestamp=1661975375 IF-MIB::ifDescr.53 = "Unit: 2 Slot: 0 Port: 1 Gigabit - Level" 

timestamp=1661971775 IF-MIB::ifAlias.626 = "ServerA LAG" 

timestamp=1661971775 IF-MIB::ifDescr.626 = " Link Aggregate 1" 

I want to generate fields when this data is ingested into Splunk.  I do not want to do this during search.  (So probably using transforms.conf and regex).  I think there’s ways to do this with Python as well, but I don’t have the experience or time to go down that path.

The result of the above 6 rows of example data would have the following fields for each line respectively:

Alias=1, Description=”ServerA Port 1”

Alias=1, Unit=1, Port=1

Alias=53, Description=”ServerA Port 2”

Alias=53, Unit=2, Port=1

Alias=626, Description=”ServerA LAG”

Alias=626, Lag=1

I can build field extractions or a manual regex to do one of these lines individually, but not all together.  I also wonder if pure regex is the way to go here as it seems like it would take many "steps" with this many parameters.

Would really appreciate the help from someone with the knowledge and experience of using transforms to get this done.  🙂

Thank you in advance for solutions or recommendations.

Labels (2)
Tags (2)
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...