Forum Discussion

Stefan_W's avatar
2 years ago

Anyone using "TextMatch" in a DataSource Datapoint? (without hard-coding the regex)

Is anyone using the "TextMatch" type of Datapoint Post-Processing Interpreter with a Property?  (search on the page for "TextMatch")

I'm building a DataSource using SNMP as the Collect method (to try and keep things simple) and I want to be able to parse the full output from nsExtendOutputFull to look for an expected substring. 

For example if my SNMPd conf entry is 

extend splunk-status /usr/sbin/service splunk status

then I thought I could have a Device Property (or Instance-Level Property) containing the expected "splunkd is running" and then in the Datapoint regex it would be possible to drop in that Property name tokenized like ##TextMatch.substring##

Unless I'm mistaken, the only other way I'd be able to post-process text strings like this would be either

  • a Groovy Complex Datapoint, or
  • to completely switch the DataSource over from SNMP Collect to Script and write everything in Groovy (which I could do but I'm hoping to avoid that complexity)

Thoughts? Comments? Am I completely out of my mind to be thinking about a Property in a TextMatch Datapoint?

1 Reply

  • Switch to scripted and use SSH. Avoids having to configure anything on the far side and you can pull in the tokenized regex patter right into the script. SNMP extensions are not scalable.