Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

rex field extraction does not work once moved to field extraction

$
0
0
I am parsing data from a trap def as follows: ======================== Trap attributes ========================= Timestamp: 'September 19, 2017 6:56:50 AM CDT' Agent: '10.10.54.xxx' Enterprise OID: '.1.3.6.1.4.1.xxxxx' Generic Type: '6' Specific Type: '2' Varbinds: [oid]->[varbind] '.1.3.6.1.2.1.1.1.0' --> 'dynaTrace Trap' '.1.3.6.1.4.1.31094.1.1' --> 'Application Process Unavailable (unexpected)' '.1.3.6.1.4.1.31094.1.2' --> 'Agent 'OpenPlatform-PRO-service-kyc-validation@ip-10-13-12-248' connection lost' '.1.3.6.1.4.1.31094.1.3' --> 'Connection to a previously connected Application Process/Agent has been lost and agent has not been able to disconnect..' '.1.3.6.1.4.1.31094.1.4' --> 'Error' '.1.3.6.1.4.1.31094.1.5' --> 'b7250936-8068-41e3-892a-e0bec55xxxxx' '.1.3.6.1.4.1.31094.1.6' --> 'albdynaserxxx' '.1.3.6.1.4.1.31094.1.7' --> 'Monitoring' '.1.3.6.1.4.1.31094.1.8' --> '2017091906xxxx' '.1.3.6.1.4.1.31094.1.9' --> '2017091906xxxx' '.1.3.6.1.4.1.31094.1.10' --> '6s' '.1.3.6.1.4.1.31094.1.11' --> '-' '.1.3.6.1.4.1.31094.1.12' --> '-' '.1.3.6.1.4.1.31094.1.13.1' --> 'Immediate' '.1.3.6.1.4.1.31094.1.13.2' --> '0' '.1.3.6.1.4.1.31094.1.13.3' --> '0' '.1.3.6.1.4.1.31094.1.13.4' --> '60000' '.1.3.6.1.6.3.18.1.3.0' --> '10.10.54.182' My search and rex is defined like: index=\* sourcetype=InCharge-Traps OID=".1.3.6.1.4.1.31094" source!="D:\\InCharge\\SAM\\smarts\\local\\logs\\TRAP-INCHARGE-OI_en_US_UTF-8.log" | **rex "'.1.3.6.1.4.1.31094.1.2' --> '.*['\(](?P.*)(' |\))"** which produces my field Agentname=**OpenPlatform-PRO-service-kyc-validation@ip-10-13-12-248** as it should. Now I move it to the Field extractor, writing my own Regular Expression, and enter **'.1.3.6.1.4.1.31094.1.2' --> '.*['\(](?P.*)(' |\))** as my regex. This is where it all falls apart. The preview looks right and shows the correct Agentnames but when I save it and look at the new extracted field, the data is all incorrect. My props.conf looks like this: EXTRACT-Agentname = **'.1.3.6.1.4.1.31094.1.2' --> '.*[\'\(](?P.*)(\' |\))** What in the wild world of sports am I doing wrong? Thanks for the help in advance, Rcp

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>