Ah, unfortunately, there are a plethora of varbinds in the SNMP trap, with many semicolons. Here's a sample of the full trap
[2016/09/08 10:57:16 MDT] [INFO] (/trapd/client.(*TrapLogger).Info:29) [TRAP]: {ip:69.76.108.44,timestamp:1473353836411,oid:1.3.6.1.4.1.1482.20.1.1.1.1.0.1,varbinds:[{1.3.6.1.4.1.1482.20.1.2.1.4.1.13.5460:2},{1.3.6.1.4.1.1482.20.1.2.1.4.1.9.5460:8},{1.3.6.1.4.1.1482.20.1.2.1.4.1.11.5460:},{1.3.6.1.4.1.1482.20.1.2.1.4.1.14.5460:TS=232.34.1.232:34000=;Cause=Service Out Loss (one service)=;},{1.3.6.1.4.1.1482.20.1.2.1.4.1.5.5460:**Board 5, Port 1**, TS 232.34.1.232:34000},{1.3.6.1.4.1.1482.20.1.2.1.4.1.8.5460:1},{1.3.6.1.4.1.1482.20.1.2.1.4.1.10.5460:269},{1.3.6.1.2.1.1.3.0:1041h33m58.73s},{1.3.6.1.4.1.1482.20.1.2.1.4.1.3.5460:DCM},{1.3.6.1.4.1.1482.20.1.2.1.4.1.4.5460:TS Out Loss},{1.3.6.1.4.1.1482.20.1.2.1.4.1.6.5460:2016/09/08 16:57:14},{1.3.6.1.4.1.1482.20.1.2.1.4.1.7.5460:2},{1.3.6.1.4.1.1482.20.1.2.1.4.1.12.5460:0},{1.3.6.1.4.1.1482.20.1.2.1.4.1.15.5460:.1.3.6.1.2.1.47.1.1.1.1.1.501},{1.3.6.1.4.1.1482.20.1.2.1.4.1.2.5460:5460}]
I added in the preamble from the varbind I'm after to get to
rex field=raw_ "1\.3\.6\.1\.4\.1\.1482\.20\.1\.2\.1\.4\.1\.5\.[\d]+:(?[^,]+), (?[^,]+)" | table, _time, Board, Port
unfortunately, still did not return anything....
(FWIW, I did also try verbatim the rex ":(?[^,]+), (?[^,]+)" and it failed to return anything either)
S
... View more
