topic Re: Creating new field from raw event in Splunk Enterprise

Creating new field from raw event

RSS_STT — Mon, 10 Feb 2025 10:08:06 GMT

i want to create new index time field severity if raw json payload have level field value is Information.

{ "level": "Information", "ORIGIN_Severity_name": "CRITICAL", "ProductArea": "Application", "ORIGIN_Product": "Infrastructure"}

What's wrong in my transforms.conf configuration. Any help much appreciated.

transforms.conf

[severity]
REGEX = "level":\s\"(?<severity>\w+)
SOURCE_KEY = fields:level
FORMAT = severity::"INFO"
WRITE_META = true

Re: Creating new field from raw event

livehybrid — Mon, 10 Feb 2025 10:16:40 GMT

Hi @RSS_STT

The issue here is the source_key which is incorrectly set, it should be set to _raw, although _raw is the default so you could just remove that line entirely.

You also do not need to specify the naming of the extraction in the REGEX and instead use $1, so your resulting transform will look like:

[severity] REGEX = "level":\s\"(\w+) FORMAT = severity::"$1" WRITE_META = true

Please let me know how you get on and consider upvoting/karma this answer if it has helped.
Regards

Will

Re: Creating new field from raw event

RSS_STT — Mon, 10 Feb 2025 10:28:42 GMT

it helped but how can ensure that it's create severity = INFO field only when level=Information.

Re: Creating new field from raw event

livehybrid — Mon, 10 Feb 2025 11:21:36 GMT

Oh I see, sorry.

In that case you could do:

[severity] REGEX = "level":\s\"(Informational) FORMAT = severity::INFO WRITE_META = true

This means it will only set the severity field (to INFO) when level=Informational - Is this what you want, or should it be other values if not Informational?

Is there a particular reason you are looking to make this index-time instead of a search-time change?