Splunk Search

How to extract fields using regex in transforms.conf?

alex_kh
Explorer

Hello everybody

I am new to the regex topic.

I have events with folowing information:

SPIEE-WIRELESS-MIB::**bsnStationMacAddress**.0 = STRING: **a9:12:fa:13:19:8F**
CISCO-LWAPP-UMBH-CALLT-MIB::**cldcClientSSID**.0 = STRING: **Campus-WLAN**

As we can see, we can present these two (and further logs) in following format:

blabla-MIB::**FIELDNAME**.0 = Blabla: **FIELDVALUE**

I have to apply this extraction in transforms.conf
My idea is:

[mytransform]
REGEX= (?:.*\-MIB::)(.+)(?:\.0\s\=\s[a-zA-Z0-9]+:\s)(.+)
FORMAT= $1::$2

Both (.+) are the field names and field values. I have extracted them as groups but how do I define them as a Splunk fieldname and field value?

Thank you in advance

0 Karma
1 Solution

sudosplunk
Motivator

Hello, I modified your regex a little to make it take less steps to find a match (you can see results here). Give this combination a try:

props.conf:

[your_sourcetype]
REPORT-extraction_name = transform_stanza_name

transforms.conf:

[transform_stanza_name]
REGEX = MIB\:\:(.+)\.\d\s\=\sSTRING\:\s(.+)
FORMAT = $1::$2
MV_ADD = true ## Use this if you have multiple values for same field name

Deploy these configurations to your search head(s) and search for data in smart mode or verbose mode. HTH!

View solution in original post

sudosplunk
Motivator

Hello, I modified your regex a little to make it take less steps to find a match (you can see results here). Give this combination a try:

props.conf:

[your_sourcetype]
REPORT-extraction_name = transform_stanza_name

transforms.conf:

[transform_stanza_name]
REGEX = MIB\:\:(.+)\.\d\s\=\sSTRING\:\s(.+)
FORMAT = $1::$2
MV_ADD = true ## Use this if you have multiple values for same field name

Deploy these configurations to your search head(s) and search for data in smart mode or verbose mode. HTH!

Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...