I am parsing data from a trap def as follows:
======================== Trap attributes =========================
Timestamp: 'September 19, 2017 6:56:50 AM CDT'
Agent: '10.10.54.xxx'
Enterprise OID: '.1.3.6.1.4.1.xxxxx'
Generic Type: '6'
Specific Type: '2'
Varbinds: [oid]->[varbind]
'.1.3.6.1.2.1.1.1.0' --> 'dynaTrace Trap'
'.1.3.6.1.4.1.31094.1.1' --> 'Application Process Unavailable (unexpected)'
'.1.3.6.1.4.1.31094.1.2' --> 'Agent 'OpenPlatform-PRO-service-kyc-validation@ip-10-13-12-248' connection lost'
'.1.3.6.1.4.1.31094.1.3' --> 'Connection to a previously connected Application Process/Agent has been lost and agent has not been able to disconnect..'
'.1.3.6.1.4.1.31094.1.4' --> 'Error'
'.1.3.6.1.4.1.31094.1.5' --> 'b7250936-8068-41e3-892a-e0bec55xxxxx'
'.1.3.6.1.4.1.31094.1.6' --> 'albdynaserxxx'
'.1.3.6.1.4.1.31094.1.7' --> 'Monitoring'
'.1.3.6.1.4.1.31094.1.8' --> '2017091906xxxx'
'.1.3.6.1.4.1.31094.1.9' --> '2017091906xxxx'
'.1.3.6.1.4.1.31094.1.10' --> '6s'
'.1.3.6.1.4.1.31094.1.11' --> '-'
'.1.3.6.1.4.1.31094.1.12' --> '-'
'.1.3.6.1.4.1.31094.1.13.1' --> 'Immediate'
'.1.3.6.1.4.1.31094.1.13.2' --> '0'
'.1.3.6.1.4.1.31094.1.13.3' --> '0'
'.1.3.6.1.4.1.31094.1.13.4' --> '60000'
'.1.3.6.1.6.3.18.1.3.0' --> '10.10.54.182'
My search and rex is defined like:
index=\* sourcetype=InCharge-Traps OID=".1.3.6.1.4.1.31094" source!="D:\\InCharge\\SAM\\smarts\\local\\logs\\TRAP-INCHARGE-OI_en_US_UTF-8.log" | **rex "'.1.3.6.1.4.1.31094.1.2' --> '.*['\(](?P.*)(' |\))"**
which produces my field Agentname=**OpenPlatform-PRO-service-kyc-validation@ip-10-13-12-248** as it should.
Now I move it to the Field extractor, writing my own Regular Expression, and enter **'.1.3.6.1.4.1.31094.1.2' --> '.*['\(](?P.*)(' |\))** as my regex. This is where it all falls apart.
The preview looks right and shows the correct Agentnames but when I save it and look at the new extracted field, the data is all incorrect.
My props.conf looks like this:
EXTRACT-Agentname = **'.1.3.6.1.4.1.31094.1.2' --> '.*[\'\(](?P.*)(\' |\))**
What in the wild world of sports am I doing wrong?
Thanks for the help in advance,
Rcp
↧