Splunk Search

regex to pick a event

e82than
Communicator

Hi all,

I have a question to ask about using regex to recognize a field. I did manage to pick the field out from my regex testing kit. But when i try to input to splunk it can't work. I wonder where did i go wrong.

In my transforms.conf

[Ftype1]
REGEX = .*\[2\].*\[16\].*\[(1234............)\]
FORMAT = F1::$1

In my props.conf

[host::MyPC]
SHOULD_LINEMERGE = true

[Ftype2]
TRANSFORMS-Ftype1=Ftype3

What i am trying to do now is to make the field recognize-able then get splunk to stats the field. Can any one help?

0 Karma

kristian_kolb
Ultra Champion

Well one thing is that you are not referencing the transform correctly. You should put Ftype1 in props.conf where you now have Ftype3. Possibly also change the name of the transform "name" so that it's not the same as the value.

props.conf

[sourcetype]
TRANSFORMS-this_is_just_a_name = transform_stanza

transforms.conf

[transform_stanza]
REGEX blaha bhal
FORMAT blaha 

UPDATE:

Ok, if your are doing 'normal' field extractions, there is no need to use transforms. This can be done in props.conf alone.

If you need to use transforms, then you should use the REPORT- attribute rather than EXTRACT-

BUT you need to get your reference right. See where I put the 'bbbb' in the examples below. The 'aaaa' is just a name - it could be set to anything, but to avoid confusion, don't set is to the same string as 'bbbb', ok.

props.conf

[host::blaha]
REPORT-aaaa = bbbb

transforms.conf

[bbbb]
REGEX= your regex goes here
FROMAT = whatever you wish to put here

Hope this helps,

Kristian

kristian_kolb
Ultra Champion

see updates above.

0 Karma

e82than
Communicator

kristian, bear with me ok. I'm noob on this. I changed transforms into extract in props.conf as i realised i'm trying to do a search time field tagging

props.conf


[host::user-PC]
SHOULD_LINEMERGE = true
EXTRACT-banktype2=banktype3

transforms.conf


[banktype2]
REGEX = .[2].[16].*[(4679............)]
FORMAT = BANK1::$1

I'm having a problem to show a regex here. there's a dot asterisk missing in the banktype2.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...