Splunk Search

Setting host from a field within a data input file

jlixfeld
Path Finder

I have added this to $local/props.conf and $local/transforms.conf, respectively:

# props.conf
# CUSTOM

[snmp-trap]
pulldown_type = true 
maxDist = 3
TIME_FORMAT = %b %d %H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD = 32
TRANSFORMS = snmp-trap-host
REPORT-snmp-trap = snmp-trap-extractions
SHOULD_LINEMERGE = False

# transform.conf 
# CUSTOM


[snmp-trap-host]
DEST_KEY = MetaData:Host
REGEX = (?:[0-9]{1,3}\.){3}[0-9]{1,3}
FORMAT = host::$1

[snmp-trap-extractions]
REGEX = ^(\d{4}-\d{2}-\d{2})\s(\d{2}:\d{2}:\d{2})\s([a-zA-Z]*)
FORMAT = trap_oid::$3

And some sample output from the file I'm using as a data input is:

2011-10-03 10:05:40 ciscoConfigManEvent Normal "Status Events" 10.219.49.51 - Notification of a configuration management event as commandLine running commandSource

I've deleted the data input and re-added it, I've also restarted splunk.

So from the example above, I'm trying to set the host to 10.219.49.51. Problem is that it doesn't seem to be using the host from the regex in props.conf to populate the host field when I realtime search for matches since the restart.

Can anyone see anything that I've missed?

Tags (3)
0 Karma

lbowser_splunk
Splunk Employee
Splunk Employee

Pretty sure the problem is in the REGEX attribute in the [snmp-trap-host] stanza. You defined the group as a non-capturing group, which means the $1 group in the FORMAT attribute will always be blank. Furthermore, even if you remove the "?:" from the regex statement, I still don't think the group will capture the entire IP address. I recommend updating your regex code and re-testing it using an online regex testing tool. I really like this site: http://www.myezapp.com/apps/dev/regexp/show.ws

0 Karma

_d_
Splunk Employee
Splunk Employee

I think the following line in your props:

TRANSFORMS = snmp-trap-host

should be something like this: TRANSFORMS-name. Try the one below:

TRANSFORMS-trap_host = snmp-trap-host

0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...