Splunk Search

Creating fields from trap

jduraes
Explorer

Hi all,

I may be going at this in the completely wrong way, but I'm looking at extracting information from traps sent by a system, and then using them to generate reports.

So I have this trap:

SNMPv2-MIB::snmpTrapOID.0 = OID: SNMPv2-SMI::enterprises.1230.2.7.4.3 SNMPv2-SMI::enterprises.1230.2.7.4.10.4 = INTEGER: 6 SNMPv2-SMI::enterprises.1230.2.7.4.10.5 = STRING: "neptune"

The system is picking up the fields ok, like "SNMPv2-SMI::enterprises.1230.2.7.4.10.5", but then its content is "STRING: \"neptune\"".

I'm looking at removing the word "STRING: ", both quotes (""), and just keeping the rest (neptune), preferably somehow placing that into a field named "planet".

My report will then look at displaying how many times each planet was observed, sort of thing.

Is this possible? Does this reasoning make any sense? I was thinking about using rex for this, but I must be way off the mark because nothing seems to work for me...

I was trying: | rex field=_raw "STRING: \"(?.*)\""

Help, please?

Thanks

1 Solution

JSapienza
Contributor

Something like this should work ** (change to your sourcetype)

sourcetype="?????" | head 100 | rex "(?im)STRING:\s\\"(?P.+?)\\"" | top 50 PLANET

View solution in original post

0 Karma

rasingh
Path Finder

If the trapserver is net-snmp, you can use -OQ option to remove the type (STRINGS in this case).

0 Karma

southeringtonp
Motivator

Getting rid of the quotes makes it a little messy, at least if you want to allow for the possibility of spaces within the quoted string.

Here's one way:

#transforms.conf
[snmp-fields]
REGEX = \s(\S+)\s*=\s*\w+: (")?((?<=")[^"]+|(\S+))
FORMAT = $1::$3

#props.conf
[snmp]
KV_MODE = none
REPORT-snmp = snmp-fields



The trick is to consume the opening quotation mark first so that it isn't part of the capture group (i.e., the extracted field).

Then, within the capture group, use negative lookbehind to determine whether you're matching inside a quoted section (match up to the end-quote), or just matching a block of non-whitespace.

Another way would be to create two separate transforms -- one for quoted string values and one for integer and other non-string types.

0 Karma

jduraes
Explorer

I guess you're giving me something extra to read about. Thank you for that. I'll try to make something out of it, and see how I could use it. Again, thanks.

0 Karma

JSapienza
Contributor

Something like this should work ** (change to your sourcetype)

sourcetype="?????" | head 100 | rex "(?im)STRING:\s\\"(?P.+?)\\"" | top 50 PLANET

0 Karma

jduraes
Explorer

Thank you. I guess I'm more of a beginner than I thought. The key was in specifying the sourcetype; I was just casting the | rex... on its own. 😉

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...