Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

multiple matches using props.conf and regex

$
0
0

I am trying to create a props.conf EXTRACT entry to be able to handle the following lines from a Symantec Endpoint Protection 12 syslog:

Line 1 Example:

Dec 22 00:22:21 SymantecServer sepm12p01: laptop1,Category: 0,Smc,  Windows Version info:  Operating System: Windows 7 (6.1.7601 Service Pack 1)  Network  info:  No.0  "Wireless Network Connection"  64-80-99-6f-1c-cc  "Intel(R) Centrino(R) Advanced-N 6250 AGN" 192.168.1.4

Line 2 Example:

Dec 21 17:37:57 SymantecServer sepm12p01: laptop2,Category: 0,Smc,  Windows Version info:  Operating System: Windows XP (5.1.2600 Service Pack 3)  Network  info:  No.0  "Local Area Connection 3"  00-05-9a-3c-78-00  "Cisco Systems VPN Adapter" 172.20.7.235   No.1  "Local Area Connection"  00-12-3f-f0-18-b0  "Broadcom NetXtreme 57xx Gigabit Controller" 192.168.1.67

Line 3 Example:

Dec 20 08:58:22 SymantecServer sepm12p01: laptop3,Category: 0,Smc,  Windows Version info:  Operating System: Windows 7 (6.1.7601 Service Pack 1)  Network  info:  No.0  "Local Area Connection"  74-86-7a-69-5c-f8  "Intel(R) 82579LM Gigabit Network Connection" 10.80.63.239   No.1  "VMware Network Adapter VMnet1"  00-50-56-c0-00-01  "VMware Virtual Ethernet Adapter for VMnet1" 192.168.61.1   No.2  "VMware Network Adapter VMnet8"  00-50-56-c0-00-08  "VMware Virtual Ethernet Adapter for VMnet8" 192.168.176.1

What I am trying in my props.conf file is:

EXTRACT-symantec_sep12_4101 = "Network  info: \s*No.(?<s_nic_no>[0-9]+)\s+\"(?<s_nic_name>(?i)[a-zA-Z0-9`~\-_=+\[{\]}\\|;:'\"<.>/?!@#$%^&*\(\)\è\t\s]+)\"\s+(?<s_nic_mac>(?i)[a-zA-Z0-9`~\-_=+\[{\]}\\|;:'\"<.>/?!@#$%^&*\(\)\è\t\s]+)\s+\"(?<s_nic_vendor>(?i)[a-zA-Z0-9`~\-_=+\[{\]}\\|;:'\"<.>/?!@#$%^&*\(\)\è\t\s]+)\"\s+(?<s_nic_ip>[0-9\.]+)"

My issue is that when Splunk parses the fields the field 's_nic_name' grabs the lines with No.1 & No.2 descriptions and does not break them out. For example:

Example s_nic_name value #1:

Local Area Connection" a4-ba-db-b0-7c-97 "Broadcom NetXtreme 57xx Gigabit Controller" 10.80.50.188 No.1 "Wireless Network Connection

Example s_nic_name value #2:

Local Area Connection" 00-23-ae-36-d6-9b "Broadcom NetXtreme 57xx Gigabit Controller" 10.80.50.220 No.1 "Wireless Network Connection

What I would expect to only see would be more like:

Wireless Network Connection
Local Area Connection
Local Area Connection 1
Local Area Connection 2

Any help would be greatly appreciated.


Viewing all articles
Browse latest Browse all 13053

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>