Splunk Search

How to extract fields using regex in transforms.conf?

alex_kh
Explorer

Hello everybody

I am new to the regex topic.

I have events with folowing information:

SPIEE-WIRELESS-MIB::**bsnStationMacAddress**.0 = STRING: **a9:12:fa:13:19:8F**
CISCO-LWAPP-UMBH-CALLT-MIB::**cldcClientSSID**.0 = STRING: **Campus-WLAN**

As we can see, we can present these two (and further logs) in following format:

blabla-MIB::**FIELDNAME**.0 = Blabla: **FIELDVALUE**

I have to apply this extraction in transforms.conf
My idea is:

[mytransform]
REGEX= (?:.*\-MIB::)(.+)(?:\.0\s\=\s[a-zA-Z0-9]+:\s)(.+)
FORMAT= $1::$2

Both (.+) are the field names and field values. I have extracted them as groups but how do I define them as a Splunk fieldname and field value?

Thank you in advance

0 Karma
1 Solution

sudosplunk
Motivator

Hello, I modified your regex a little to make it take less steps to find a match (you can see results here). Give this combination a try:

props.conf:

[your_sourcetype]
REPORT-extraction_name = transform_stanza_name

transforms.conf:

[transform_stanza_name]
REGEX = MIB\:\:(.+)\.\d\s\=\sSTRING\:\s(.+)
FORMAT = $1::$2
MV_ADD = true ## Use this if you have multiple values for same field name

Deploy these configurations to your search head(s) and search for data in smart mode or verbose mode. HTH!

View solution in original post

sudosplunk
Motivator

Hello, I modified your regex a little to make it take less steps to find a match (you can see results here). Give this combination a try:

props.conf:

[your_sourcetype]
REPORT-extraction_name = transform_stanza_name

transforms.conf:

[transform_stanza_name]
REGEX = MIB\:\:(.+)\.\d\s\=\sSTRING\:\s(.+)
FORMAT = $1::$2
MV_ADD = true ## Use this if you have multiple values for same field name

Deploy these configurations to your search head(s) and search for data in smart mode or verbose mode. HTH!

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...