Splunk Search

transforms.conf regex extract strange fields with value $2

exmuzzy
Explorer

my transforms.conf has such lines

[api-param]
REGEX=^(\w+)=(.+?)\n
FORMAT=$1::$2

props.conf

[api]
TZ = Europe/Moscow
MAX_TIMESTAMP_LOOKAHEAD = 25
BREAK_ONLY_BEFORE = ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2},\d{3}
BREAK_ONLY_BEFORE_DATE = true
TIME_PREFIX = ^
MAX_EVENTS = 5000
CHARSET = AUTO
KV_MODE = none
NO_BINARY_CHECK = true
REPORT-st = api-param

why I've got strange fields with values $2
like index=* OK="$2" on event

2018-10-01 22:21:55,812 INFO  [   891] [AsopApi]
----------------------------
requestID=Server@1538421715802-1570361
messageID=MetroRequest@1538421715802-865639
actor=Asop->
api=AsopApi
method=asop_wr_start
type=response
elapsed=0.010
cardUID=048E48820F5D80
cardNumber=0021642560
trxID=181000000365323654
trxPCID=2EF20F6318CBEA4774DFAE6E1D18B52D
session=230873148
trxPaymentPCID=EE21AF76139B982D2CFA642BB05DC09F
trxPaymentTime=2018-10-01T22:19:11.332
result=OK
<?xml version="1.0" encoding="windows-1251"?><message><head><api_version>1.1</api_version><msg_id>230873148</msg_id><code>0</code><comment></comment><time>2018-10-01T22:21:55</time></head><body><new_balance>90.0</new_balance></body></message>
----------------------------

or index=* 0003191276="$2" on

2018-10-01 22:18:24,645 INFO  [    49] [AsopAeroexpressApi]
----------------------------
requestID=Server@1538421504531-1565469
messageID=MetroRequest@1538421504552-863049
actor=->Asop
api=AsopAeroexpressApi
method=cott_ewd_start
type=response
elapsed=0.089
cardUID=043B8D0A7F3580
cardNumber=0003191276
trxID=181000000365322716
trxPCID=14402F29670CE347D6724DC5631825D9
agent=torgwc
result=OK
headers={content-length=664, content-type=text/xml;charset=windows-1251, pragma=no-cache}
<?xml version="1.0" encoding="WINDOWS-1251"?>
<message>
  <head>
    <api_version>1.0</api_version>
    <msg_id>14402F29670CE347D6724DC5631825D9</msg_id>
    <code>0</code>
    <comment></comment>
    <time>2018-10-01T22:18:25</time>
  </head>
  <body>
    <res_code>0</res_code>
    <balance>675.00</balance>
    <blocks>
      <block>
        <number>0</number>
        <data>RdsQAwsezhlqYqQAAAAAAA==</data>
      </block>
      <block>
        <number>1</number>
        <data>NSgsM4wAFABB6xQAHKURbw==</data>
      </block>
      <block>
        <number>2</number>
        <data>NSgsM4wAFABB6xQAHKURbw==</data>
      </block>
    </blocks>
  </body>
</message>
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...