Splunk Search

Custom Search - Help needed.

Path Finder

I have trap data coming onto my Splunk Server ... the data looks like this

1.3.6.1.4.1.3279.1.1.8.1.35.2 = ObjectSyntax: simple=SimpleSyntax: string=application_name

my key is "1.3.6.1.4.1.3279.1.1.8.1.35.2" and my value is at the end "application_name"

can some one help me with the search query here.

Tags (2)
1 Solution

Splunk Employee
Splunk Employee

Assumption: Every event has the same data between the OID and the application_name.

Use a transform. Perhaps something like this (based on an answers entry😞

In props.conf do:

[yoursourcetypehere]
REPORT-myoidextract = getmyoiddata

Then in transforms.conf do:

[getmyoiddata]
REGEX = (?.*)\s=\sObjectSyntax:\ssimple=SimpleSyntax:\s+string=(?.*)
FORMAT = $1::$2

See if that works (or muss with it some if it's not exact).

View solution in original post

Splunk Employee
Splunk Employee

Assumption: Every event has the same data between the OID and the application_name.

Use a transform. Perhaps something like this (based on an answers entry😞

In props.conf do:

[yoursourcetypehere]
REPORT-myoidextract = getmyoiddata

Then in transforms.conf do:

[getmyoiddata]
REGEX = (?.*)\s=\sObjectSyntax:\ssimple=SimpleSyntax:\s+string=(?.*)
FORMAT = $1::$2

See if that works (or muss with it some if it's not exact).

View solution in original post

Path Finder

This did my job

REGEX = \s1.3.6.1.4.1.3279.1.1.8.1.35.2\s=\sObjectSyntax:\s+simple=SimpleSyntax:\s+string=(?.*)

... but had to also mention the below part ... since it was writing the rest of the message also to the above one.

\s+\s+\s1.3.6.1.4.1.3279.1.1.8.1.35.3\s=\sObjectSyntax:\s+simple=SimpleSyntax:\s+string=(?.*)

Thanks Mr. JTrucks.

Path Finder

I am trying to create custom key-value pairs ... my key is "1.3.6.1.4.1.3279.1.1.8.1.35.2" and my value is at the end "application_name".

0 Karma

Super Champion

What are you searching for exactly?

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!