Jotne / MikroTik

MikroTik app for use with Splunk
10 stars 4 forks source link

Split neighbor on ; and \n #5

Closed eloekset closed 1 year ago

eloekset commented 1 year ago

I'm not sure whether this is a real issue, but it looks like the split on "\n" works for most, but not all properties. From my syslog: image

I cannot reproduce the output running the /ip neighbor get command on the terminal, but I'm just guessing that some of these properties are split by semicolon.

I haven't tested it, but maybe this would split by both newline and semicolon?

:local semicolon [:find $value ";"]
:if ([$newline]>0 or [$semicolon]>0) do = {

image

I may also break things if Mikrotik should choose to use semicolons in their content somewhere.

Jotne commented 1 year ago

I thought I did not see the problem. But on a router with 7.11b2 I do see the error, will tryfix

Jotne commented 1 year ago

This is a but in RouterOS. It fails to spilt Key Value correctly on some version.

Jotne commented 1 year ago

Mostly fixed in latest commit. Problem was multi value fields. Like a neighbor router my be discovered by several type of protocol

eloekset commented 1 year ago

Thanks! I've updated the view file on the Splunk app and the script on all of my devices. I'll report back once the neighbor part has been logged again.

Jotne commented 1 year ago

Fixed with better extraction code.