Splunk Search

[RESOLVED] Regex works with rex but errors in transforms.conf

ww9rivers
Communicator

[RESOLVED] The extract was defined in the transforms.conf in an app which had the "Sharing for config file-only objects" set to "This app only". Once I log in as "admin" and set that to "All apps", the "cisco-asa-access-list-extract" definition became available and working as expected.


I have a regular expression to parse Cisco ASA logs regarding ACL rules applied. The regex works fine and I see extracted fields when used with the "rex" command inline, as in:

sourcetype=cisco_asa -6-106100 | rex "(?<asa_ip>[\d.]+)\s+%\S+-6-106100:\s+access-list\s+(?<asa_aclname>\S+)\s+(?<asa_aclres>\w+)\s+(?<asa_proto>\w+)\s+(?<asa_srcint>[^/]+)/(?<asa_srcip>[^\(]+)\((?<asa_srcport>\d+)\)\s+\->\s+(?<asa_dstint>[^/]+)/(?<asa_dstip>[^\(]+)\((?<asa_dstport>\d+)\)\s+hit-cnt\s+(?<asa_aclhits>\d+)\s+(?<asa_aclhitinterval>.+)\s+\[(?<asa_linehash>[^,]+),\s+(?<asa_elementhash>[^\]]+)\]"

But, when I put the regex in a transforms.conf file:

[cisco-asa-access-list-extract]
REGEX = "(?<asa_ip>[\d.]+)\s+%\S+-6-106100:\s+access-list\s+(?<asa_aclname>\S+)\s+(?<asa_aclres>\w+)\s+(?<asa_proto>\w+)\s+(?<asa_srcint>[^/]+)/(?<asa_srcip>[^\(]+)\((?<asa_srcport>\d+)\)\s+\->\s+(?<asa_dstint>[^/]+)/(?<asa_dstip>[^\(]+)\((?<asa_dstport>\d+)\)\s+hit-cnt\s+(?<asa_aclhits>\d+)\s+(?<asa_aclhitinterval>.+)\s+\[(?<asa_linehash>[^,]+),\s+(?<asa_elementhash>[^\]]+)\]"

I get an error when I try to use that stanza with an "extract" command:

sourcetype=cisco_asa -6-106100 | extract cisco-asa-access-list-extract

The error message is:

Error in 'extract' command: Failed to parse the key-value pair configuration for transform 'cisco-asa-access-list-extract'.

Thanks in advance for your insights.

[EDIT-1]: By the way, I do have a props.conf file, with these lines:

[cisco_asa]
NO_BINARY_CHECK = 1
REPORT-asa-accesslist = cisco-asa-access-list-extract

[EDIT-2]: My search head is version 5.0.3, build 163460, running on SuSE 11.1 Linux.

[EDIT-3]: I get the same error if I give "extract" an non-existing extraction stanza, such as "| extract abcdefg". So I suspect that it is a problem with something other than the regex.

0 Karma

Ayn
Legend

Your regex won't match because you're including the leading and ending quotes. Splunk treats whatever you put after "REGEX =" as what it literally should look for, so it will be looking for the quotes you put in there. Remove them and things should start working...if you have permissions set correctly that is, because the error message you're getting implies that Splunk might not be finding the transform you defined for some reason. If you put it in an app and are trying to access the transform from another app, you might need to modify permissions so that the transform is shared globally.

ww9rivers
Communicator

I should have said that I used the REGEX in the transforms.conf both with and without the quotes. I get the same error message in both cases.

I should also say that I have used the same regex in the "rex" statement without the quotes and got an error for that -- "rex" will report on "[^/]" as an error.

I understand once transform works, I don't need to explicitly do "extract". I ran it explicitly to troubleshoot because the transform is not working.

0 Karma

kristian_kolb
Ultra Champion

Also, given that the TRANSFORM is referenced through a REPORT in props.conf, you should not need to call it through | extract in the search query, it should be done automatically.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...