Hi All,
Can someone help me to parse the fields either at indexing or through searches? Splunk detects the default fields as enterprises.48099.1.1.1/enterprises.48099.1.1.2 etc., . but we only need the value inside the quotations like below.
enterprises.48099.1.1.2 = STRING: "Monitoring error (SQL Server data collection)". But we need field as below:
field1 = Monitoring error (SQL Server data collection)
Sample Data:
2019-10-01 21:05:24 monspk-sqlmon-01.local [UDP: [111.12.171.01]:64274->[111.12.171.55]:162]:
DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (0) 0:00:00.00 SNMPv2-MIB::snmpTrapOID.0 = OID: SNMPv2-SMI::enterprises.48099.1.1 SNMPv2-SMI::enterprises.48099.1.1.1 = STRING: "2360689" SNMPv2-SMI::enterprises.48099.1.1.2 = STRING: "Monitoring error (SQL Server data collection)" SNMPv2-SMI::enterprises.48099.1.1.3 = STRING: "SQL Monitor cannot collect data from the SQL Server instance." SNMPv2-SMI::enterprises.48099.1.1.4 = STRING: "2019-10-01 19:05:00Z" SNMPv2-SMI::enterprises.48099.1.1.5 = STRING: "Low" SNMPv2-SMI::enterprises.48099.1.1.6 = STRING: "monspk-sql8-bi01" SNMPv2-SMI::enterprises.48099.1.1.7 = STRING: "https://monspk-sqlmon-01.local:8443/show/alert/2360689?baseMonitorId=288e5411-856f-4661-97c1-3c6cc8b5d16c" SNMPv2-SMI::enterprises.48099.1.1.8 = STRING: "Raised" SNMPv2-SMI::enterprises.48099.1.1.9 = "" SNMPv2-SMI::enterprises.48099.1.1.10 = "" SNMPv2-SMI::enterprises.48099.1.1.11 = STRING: "monspk-sql8-clust.local" SNMPv2-SMI::enterprises.48099.1.1.12 = STRING: "monspk-SQL8-CLUST - SQL Alert"
Can someone please help with this to parse at indexing or through rex.
Thanks!
Here's one way. Since all of the strings you want to extract have no unique identifier, this rex
command will pull them all into a multivalue field called 'fields'. Then you can use mvindex
to access the individual fields.
... | rex max_match=0 "STRING:\s\"(?<fields>[^\"]+)" | eval field1=mvindex(fields,0), field2=mvindex(fields, 1) ...
Hi @richgalloway,
Is there a specific reason you wouldn't use mvexpand
? Just curious.
Cheers,
Jacob
mvexpand
gives you a different event for each value in a multi-value field. Using mvindex
keeps all of the fields associated with the same event.