Splunk Search

How to extract fields using regex in transforms.conf?

alex_kh
Explorer

Hello everybody

I am new to the regex topic.

I have events with folowing information:

SPIEE-WIRELESS-MIB::**bsnStationMacAddress**.0 = STRING: **a9:12:fa:13:19:8F**
CISCO-LWAPP-UMBH-CALLT-MIB::**cldcClientSSID**.0 = STRING: **Campus-WLAN**

As we can see, we can present these two (and further logs) in following format:

blabla-MIB::**FIELDNAME**.0 = Blabla: **FIELDVALUE**

I have to apply this extraction in transforms.conf
My idea is:

[mytransform]
REGEX= (?:.*\-MIB::)(.+)(?:\.0\s\=\s[a-zA-Z0-9]+:\s)(.+)
FORMAT= $1::$2

Both (.+) are the field names and field values. I have extracted them as groups but how do I define them as a Splunk fieldname and field value?

Thank you in advance

0 Karma
1 Solution

sudosplunk
Motivator

Hello, I modified your regex a little to make it take less steps to find a match (you can see results here). Give this combination a try:

props.conf:

[your_sourcetype]
REPORT-extraction_name = transform_stanza_name

transforms.conf:

[transform_stanza_name]
REGEX = MIB\:\:(.+)\.\d\s\=\sSTRING\:\s(.+)
FORMAT = $1::$2
MV_ADD = true ## Use this if you have multiple values for same field name

Deploy these configurations to your search head(s) and search for data in smart mode or verbose mode. HTH!

View solution in original post

sudosplunk
Motivator

Hello, I modified your regex a little to make it take less steps to find a match (you can see results here). Give this combination a try:

props.conf:

[your_sourcetype]
REPORT-extraction_name = transform_stanza_name

transforms.conf:

[transform_stanza_name]
REGEX = MIB\:\:(.+)\.\d\s\=\sSTRING\:\s(.+)
FORMAT = $1::$2
MV_ADD = true ## Use this if you have multiple values for same field name

Deploy these configurations to your search head(s) and search for data in smart mode or verbose mode. HTH!

View solution in original post

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!