Splunk Enterprise

Should I use Custom transform or RegEx for my search?

bharrell
Path Finder

I have a sourcetype which contains raw SNMP data which looks like this (port definitions for network switches):

timestamp=1661975375 IF-MIB::ifAlias.1 = "ServerA Port 1" 

timestamp=1661975375 IF-MIB::ifDescr.1 = "Unit: 1 Slot: 0 Port: 1 Gigabit - Level" 

timestamp=1661975375 IF-MIB::ifAlias.53 = "ServerA Port 2" 

timestamp=1661975375 IF-MIB::ifDescr.53 = "Unit: 2 Slot: 0 Port: 1 Gigabit - Level" 

timestamp=1661971775 IF-MIB::ifAlias.626 = "ServerA LAG" 

timestamp=1661971775 IF-MIB::ifDescr.626 = " Link Aggregate 1" 

I want to generate fields when this data is ingested into Splunk.  I do not want to do this during search.  (So probably using transforms.conf and regex).  I think there’s ways to do this with Python as well, but I don’t have the experience or time to go down that path.

The result of the above 6 rows of example data would have the following fields for each line respectively:

Alias=1, Description=”ServerA Port 1”

Alias=1, Unit=1, Port=1

Alias=53, Description=”ServerA Port 2”

Alias=53, Unit=2, Port=1

Alias=626, Description=”ServerA LAG”

Alias=626, Lag=1

I can build field extractions or a manual regex to do one of these lines individually, but not all together.  I also wonder if pure regex is the way to go here as it seems like it would take many "steps" with this many parameters.

Would really appreciate the help from someone with the knowledge and experience of using transforms to get this done.  🙂

Thank you in advance for solutions or recommendations.

Labels (1)
Tags (2)
0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...