How to extract fields using regex in transforms.conf?

[alex_kh]

Hello everybody

I am new to the regex topic.

I have events with folowing information:

SPIEE-WIRELESS-MIB::**bsnStationMacAddress**.0 = STRING: **a9:12:fa:13:19:8F**
CISCO-LWAPP-UMBH-CALLT-MIB::**cldcClientSSID**.0 = STRING: **Campus-WLAN**

As we can see, we can present these two (and further logs) in following format:

blabla-MIB::**FIELDNAME**.0 = Blabla: **FIELDVALUE**

I have to apply this extraction in transforms.conf
My idea is:

[mytransform]
REGEX= (?:.*\-MIB::)(.+)(?:\.0\s\=\s[a-zA-Z0-9]+:\s)(.+)
FORMAT= $1::$2

Both (.+) are the field names and field values. I have extracted them as groups but how do I define them as a Splunk fieldname and field value?

Thank you in advance

[sudosplunk · Accepted solution]

Hello, I modified your regex a little to make it take less steps to find a match (you can see results here). Give this combination a try:

props.conf:

[your_sourcetype]
REPORT-extraction_name = transform_stanza_name

transforms.conf:

[transform_stanza_name]
REGEX = MIB\:\:(.+)\.\d\s\=\sSTRING\:\s(.+)
FORMAT = $1::$2
MV_ADD = true ## Use this if you have multiple values for same field name

Deploy these configurations to your search head(s) and search for data in smart mode or verbose mode. HTH!