Splunk Search

How to extract fields using regex in transforms.conf?

alex_kh
Explorer

Hello everybody

I am new to the regex topic.

I have events with folowing information:

SPIEE-WIRELESS-MIB::**bsnStationMacAddress**.0 = STRING: **a9:12:fa:13:19:8F**
CISCO-LWAPP-UMBH-CALLT-MIB::**cldcClientSSID**.0 = STRING: **Campus-WLAN**

As we can see, we can present these two (and further logs) in following format:

blabla-MIB::**FIELDNAME**.0 = Blabla: **FIELDVALUE**

I have to apply this extraction in transforms.conf
My idea is:

[mytransform]
REGEX= (?:.*\-MIB::)(.+)(?:\.0\s\=\s[a-zA-Z0-9]+:\s)(.+)
FORMAT= $1::$2

Both (.+) are the field names and field values. I have extracted them as groups but how do I define them as a Splunk fieldname and field value?

Thank you in advance

0 Karma
1 Solution

sudosplunk
Motivator

Hello, I modified your regex a little to make it take less steps to find a match (you can see results here). Give this combination a try:

props.conf:

[your_sourcetype]
REPORT-extraction_name = transform_stanza_name

transforms.conf:

[transform_stanza_name]
REGEX = MIB\:\:(.+)\.\d\s\=\sSTRING\:\s(.+)
FORMAT = $1::$2
MV_ADD = true ## Use this if you have multiple values for same field name

Deploy these configurations to your search head(s) and search for data in smart mode or verbose mode. HTH!

View solution in original post

sudosplunk
Motivator

Hello, I modified your regex a little to make it take less steps to find a match (you can see results here). Give this combination a try:

props.conf:

[your_sourcetype]
REPORT-extraction_name = transform_stanza_name

transforms.conf:

[transform_stanza_name]
REGEX = MIB\:\:(.+)\.\d\s\=\sSTRING\:\s(.+)
FORMAT = $1::$2
MV_ADD = true ## Use this if you have multiple values for same field name

Deploy these configurations to your search head(s) and search for data in smart mode or verbose mode. HTH!

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...