Splunk의 역슬래시 - 2nd

웹 UI의 정규표현식은 \나 \\를 모두 \로 인식한다. 결과적으로 \]를 특수문자로 인식해서 문자클래스가 완성되지 못함.

\\\를 입력해야 세 번째 \를 순수문자 \로 인식한다.

To replace a backslash ( \ ) character, you must escape the backslash twice. This is because the replace function occurs inside an eval expression. The eval expression performs one level of escaping before passing the regular expression to PCRE. Then PCRE performs its own escaping

설정 파일에서는

다음은 props.conf와 transforms.conf 내역.

[winevent]
REPORT-test= test

[test]
SOURCE_KEY = Message
REGEX = User: ([^\\\]+)\\\(\S+)
FORMAT = test1::$1 test2::$2

선행하는 \\를 순수문자 \로 인식하면서 세 번째 \는 다시 특수문자로 동작. 결과적으로 문자클래스가 완성되지 않는다.

PS C:\Splunk\bin> .\splunk.exe restart
Splunkd: Stopped

Splunk> Be an IT superhero. Go home early.

        Checking http port [8000]: open
        Checking mgmt port [8089]: open
        Checking appserver port [127.0.0.1:8065]: open
        Checking kvstore port [8191]: open
        Checking configuration... Done.
        Checking critical directories...        Done
        Checking indexes...
                (skipping validation of index paths because not running as LocalSystem)
                Validated: _audit _configtracker _internal _introspection _metrics _metrics_rollup _telemetry _thefishbucket apache apache_basic evtx history iis iis_basic main pcap secure secure_basic summary test winevent winfirewall
        Done
        Checking filesystem compatibility...  Done
                        Bad regex value: 'User: ([^\\\]+)\\\(\S+)', of param: transforms.conf / [test] / REGEX; why: missing terminating ] for character class
                One or more regexes in your configuration are not valid. For details, please see btool.log or directly above.
        Done
        Checking default conf files for edits...
        Validating installed files against hashes from 'C:\Splunk\splunk-9.1.3-d95b3299fa65-windows-64-manifest'
        All installed files intact.
        Done
All preliminary checks passed.

Starting splunk server daemon (splunkd)...

Splunkd: Starting (pid 24296)
Done


Waiting for web server at http://127.0.0.1:8000 to be available.... Done


If you get stuck, we're here to help.
Look for answers here: http://docs.splunk.com

The Splunk web interface is at http://MHKANG:8000

\\로 수정.

[test]
SOURCE_KEY = Message
REGEX = User: ([^\\]+)\\(\S+)
FORMAT = test1::$1 test2::$2

관련 글

• Splunk의 역슬래시
• Splunk의 fillnull
• Splunk의 chart 정렬
• Splunk의 makeresults
• Splunk의 대소문자 구분