Splunk Search

field extraction help

hello_world15
Engager

Hi All,

I am a newbie on splunk and I have the following events:

IF-MIB::ifInOctets.502 = Counter32: 675328773

IF-MIB::ifInOctets.501 = Counter32: 407638105

And would like to extract the info like this.
key=ifInOctets.502, value=675328773
key=ifInOctets.501, value=407638105

what should I configure in transforms.conf? Thanks for your help.

Tags (1)
0 Karma
1 Solution

Ayn
Legend

Assuming that the leading "IF-MIB::" and the string "Counter32:" are constant for all events you want to extract this from, put something like this in transforms.conf:

[extract_snmp]
REGEX = IF-MIB::(\S+) = Counter32: (\d+)
FORMAT = $1::$2

Then refer to it like this in props.conf:

[yoursourcetype]
REPORT-snmpextract = extract_snmp

View solution in original post

0 Karma

hello_world15
Engager

Thanks alot.

0 Karma

Ayn
Legend

Assuming that the leading "IF-MIB::" and the string "Counter32:" are constant for all events you want to extract this from, put something like this in transforms.conf:

[extract_snmp]
REGEX = IF-MIB::(\S+) = Counter32: (\d+)
FORMAT = $1::$2

Then refer to it like this in props.conf:

[yoursourcetype]
REPORT-snmpextract = extract_snmp
0 Karma

Ayn
Legend

No problem. Could you please mark my answer as accepted if this solved your issue? Thanks!

0 Karma

Ayn
Legend

Something like this should work (and be more generic):

IF-MIB::(\S+) = [^:]+: (\S+)

hello_world15
Engager

Thanks alot.

One stupid question: how can I modify the REGEX to match this also.

IF-MIB::ifDescr.501 = STRING: ge-0/0/0

Thanks alot.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...