[RESOLVED] Regex works with rex but errors in transforms.conf

[ww9rivers]

[RESOLVED] The extract was defined in the transforms.conf in an app which had the "Sharing for config file-only objects" set to "This app only". Once I log in as "admin" and set that to "All apps", the "cisco-asa-access-list-extract" definition became available and working as expected.

---

I have a regular expression to parse Cisco ASA logs regarding ACL rules applied. The regex works fine and I see extracted fields when used with the "rex" command inline, as in:

sourcetype=cisco_asa -6-106100 | rex "(?<asa_ip>[\d.]+)\s+%\S+-6-106100:\s+access-list\s+(?<asa_aclname>\S+)\s+(?<asa_aclres>\w+)\s+(?<asa_proto>\w+)\s+(?<asa_srcint>[^/]+)/(?<asa_srcip>[^\(]+)\((?<asa_srcport>\d+)\)\s+\->\s+(?<asa_dstint>[^/]+)/(?<asa_dstip>[^\(]+)\((?<asa_dstport>\d+)\)\s+hit-cnt\s+(?<asa_aclhits>\d+)\s+(?<asa_aclhitinterval>.+)\s+\[(?<asa_linehash>[^,]+),\s+(?<asa_elementhash>[^\]]+)\]"

But, when I put the regex in a transforms.conf file:

[cisco-asa-access-list-extract]
REGEX = "(?<asa_ip>[\d.]+)\s+%\S+-6-106100:\s+access-list\s+(?<asa_aclname>\S+)\s+(?<asa_aclres>\w+)\s+(?<asa_proto>\w+)\s+(?<asa_srcint>[^/]+)/(?<asa_srcip>[^\(]+)\((?<asa_srcport>\d+)\)\s+\->\s+(?<asa_dstint>[^/]+)/(?<asa_dstip>[^\(]+)\((?<asa_dstport>\d+)\)\s+hit-cnt\s+(?<asa_aclhits>\d+)\s+(?<asa_aclhitinterval>.+)\s+\[(?<asa_linehash>[^,]+),\s+(?<asa_elementhash>[^\]]+)\]"

I get an error when I try to use that stanza with an "extract" command:

sourcetype=cisco_asa -6-106100 | extract cisco-asa-access-list-extract

The error message is:

Error in 'extract' command: Failed to parse the key-value pair configuration for transform 'cisco-asa-access-list-extract'.

Thanks in advance for your insights.

[EDIT-1]: By the way, I do have a props.conf file, with these lines:

[cisco_asa]
NO_BINARY_CHECK = 1
REPORT-asa-accesslist = cisco-asa-access-list-extract

[EDIT-2]: My search head is version 5.0.3, build 163460, running on SuSE 11.1 Linux.

[EDIT-3]: I get the same error if I give "extract" an non-existing extraction stanza, such as "| extract abcdefg". So I suspect that it is a problem with something other than the regex.

[Ayn]

Your regex won't match because you're including the leading and ending quotes. Splunk treats whatever you put after "REGEX =" as what it literally should look for, so it will be looking for the quotes you put in there. Remove them and things should start working...if you have permissions set correctly that is, because the error message you're getting implies that Splunk might not be finding the transform you defined for some reason. If you put it in an app and are trying to access the transform from another app, you might need to modify permissions so that the transform is shared globally.

[ww9rivers]

I should have said that I used the REGEX in the transforms.conf both with and without the quotes. I get the same error message in both cases.

I should also say that I have used the same regex in the "rex" statement without the quotes and got an error for that -- "rex" will report on "[^/]" as an error.

I understand once transform works, I don't need to explicitly do "extract". I ran it explicitly to troubleshoot because the transform is not working.

[kristian_kolb]

Also, given that the TRANSFORM is referenced through a REPORT in props.conf, you should not need to call it through | extract in the search query, it should be done automatically.