I am trying to create a props.conf EXTRACT entry to be able to handle the following lines from a Symantec Endpoint Protection 12 syslog:
Line 1 Example:
Dec 22 00:22:21 SymantecServer sepm12p01: laptop1,Category: 0,Smc, Windows Version info: Operating System: Windows 7 (6.1.7601 Service Pack 1) Network info: No.0 "Wireless Network Connection" 64-80-99-6f-1c-cc "Intel(R) Centrino(R) Advanced-N 6250 AGN" 192.168.1.4
Line 2 Example:
Dec 21 17:37:57 SymantecServer sepm12p01: laptop2,Category: 0,Smc, Windows Version info: Operating System: Windows XP (5.1.2600 Service Pack 3) Network info: No.0 "Local Area Connection 3" 00-05-9a-3c-78-00 "Cisco Systems VPN Adapter" 172.20.7.235 No.1 "Local Area Connection" 00-12-3f-f0-18-b0 "Broadcom NetXtreme 57xx Gigabit Controller" 192.168.1.67
Line 3 Example:
Dec 20 08:58:22 SymantecServer sepm12p01: laptop3,Category: 0,Smc, Windows Version info: Operating System: Windows 7 (6.1.7601 Service Pack 1) Network info: No.0 "Local Area Connection" 74-86-7a-69-5c-f8 "Intel(R) 82579LM Gigabit Network Connection" 10.80.63.239 No.1 "VMware Network Adapter VMnet1" 00-50-56-c0-00-01 "VMware Virtual Ethernet Adapter for VMnet1" 192.168.61.1 No.2 "VMware Network Adapter VMnet8" 00-50-56-c0-00-08 "VMware Virtual Ethernet Adapter for VMnet8" 192.168.176.1
What I am trying in my props.conf file is:
EXTRACT-symantec_sep12_4101 = "Network info: \s*No.(?<s_nic_no>[0-9]+)\s+\"(?<s_nic_name>(?i)[a-zA-Z0-9`~\-_=+\[{\]}\\|;:'\"<.>/?!@#$%^&*\(\)\è\t\s]+)\"\s+(?<s_nic_mac>(?i)[a-zA-Z0-9`~\-_=+\[{\]}\\|;:'\"<.>/?!@#$%^&*\(\)\è\t\s]+)\s+\"(?<s_nic_vendor>(?i)[a-zA-Z0-9`~\-_=+\[{\]}\\|;:'\"<.>/?!@#$%^&*\(\)\è\t\s]+)\"\s+(?<s_nic_ip>[0-9\.]+)"
My issue is that when Splunk parses the fields the field 's_nic_name' grabs the lines with No.1 & No.2 descriptions and does not break them out. For example:
Example s_nic_name value #1:
Local Area Connection" a4-ba-db-b0-7c-97 "Broadcom NetXtreme 57xx Gigabit Controller" 10.80.50.188 No.1 "Wireless Network Connection
Example s_nic_name value #2:
Local Area Connection" 00-23-ae-36-d6-9b "Broadcom NetXtreme 57xx Gigabit Controller" 10.80.50.220 No.1 "Wireless Network Connection
What I would expect to only see would be more like:
Wireless Network Connection
Local Area Connection
Local Area Connection 1
Local Area Connection 2
Any help would be greatly appreciated.