Splunk Search
Highlighted

Key-value pair extraction -- regex help

Super Champion

We have some snmp data and want to extract the data as a key-value pair

Sample

var.12345.5.5 = INTEGER: 10 myTag::var.12345.5.9 = STRING: "abc"    myTag::var.12345.5.3 = STRING: "admin"  myTag::var.12345.5.4 = STRING: "developer"
var.12345.5.5 = INTEGER: 10 myTag::var.12345.5.9 = STRING: "xyz"    myTag::var.12345.5.3 = STRING: "user1"  myTag::var.12345.5.4 = STRING: "support"

output required

var_12345_5_9,var_12345_5_3,var_12345_5_4
abc,admin,developer
xyz,user1,support

I tried a basic

REGEX=var\.([^ ]+)\s=\s(\S+)
FORMAT = $1::$2
CLEAN_KEYS = true

But can you please help in making it a bit more better?

0 Karma
Highlighted

Re: Key-value pair extraction -- regex help

SplunkTrust
SplunkTrust

Try this

REGEX=(var\S+)\s+=\s+[^\"]+([^\"]+)
FORMAT = $1::$2
CLEAN_KEYS = true

View solution in original post

Highlighted

Re: Key-value pair extraction -- regex help

Super Champion

cheers. it worked. I had to make a slight amendment, but the concept is the same.

0 Karma