Splunk Search

How to extract fields from multiline events at search time using props.conf?

ashabc
Contributor

I am able to extract some fields, but not all from sample data as per below for 2 events. Please note that variable, type, and value occurs multiple times in an event and the number of recurrences can vary from one event to another. In the 1st event, these combinations (variable, type and value) occur 6 times, whereas in the 2nd event, only 2 times. How can I extract these fields at search time via props.conf?

>>>> 02 Dec 2016 11:11:58 - Unhandled (Source not monitored)

SNMPv2 Trap (enterpriseSpecific = 83)
Generic: 6
Specific: 83
Enterprise Oid: 1.3.6.1.4.1.14179.2.6.3
Source: 10.x.x.x
Community: xxxxx
Variable: 1.3.6.1.2.1.1.3.0
Type: Time Click
Value: 1827840700
Variable: 1.3.6.1.6.3.1.1.4.1.0
Type: OID
Value: 1.3.6.1.4.1.14179.2.6.3.83
Variable: 1.3.6.1.4.1.14179.2.2.1.1.1.0
Type: String
Value: 00-50-56-8A-18-62
Variable: 1.3.6.1.4.1.14179.2.2.1.1.3.0
Type: String
Value: 
Variable: 1.3.6.1.4.1.14179.2.5.22.1.2.0
Type: Integer
Value: 4
Variable: 1.3.6.1.4.1.14179.2.6.2.69.0
Type: Integer
Value: 2



>>>> 02 Dec 2016 14:00:33 - Unhandled (Source not monitored)

SNMPv1 Trap (enterpriseSpecific = 1)
Generic: 6
Specific: 1
Enterprise Oid: 1.3.6.1.4.1.9.9.43.2
Source: 10.x.x.x
Community: xxxxx
Variable: 1.3.6.1.4.1.9.9.43.1.1.6.1.3.60802
Type: Integer
Value: 2
Variable: 1.3.6.1.4.1.9.9.43.1.1.6.1.4.60802
Type: Integer
Value: 2
Variable: 1.3.6.1.4.1.9.9.43.1.1.6.1.5.60802
Type: Integer
Value: 3
0 Karma

sundareshr
Legend

Try this

props.conf

REPORT-kvpairs = kvpairs

transforms.conf

[kvpairs]
REGEX = (\w+):\s([^\n\r\t]+
FORMAT = $1::$2
MV_ADD = True

MV_ADD = [true|false]
* NOTE: This attribute is only valid for search-time field extractions.
* Optional. Controls what the extractor does when it finds a field which
already exists.
* If set to true, the extractor makes the field a multivalued field and
appends the newly found value, otherwise the newly found value is
discarded.
* Defaults to false

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...