topic Re: What is [accepted_keys] in transforms.conf? in Getting Data In

What is [accepted_keys] in transforms.conf?

loudsong — Sun, 09 Jun 2013 23:34:24 GMT

I noticed that in Splunk 5.0.3, transforms.conf has a new section called [accepted_keys]. Does anyone have an example of how this can be used?

Re: What is [accepted_keys] in transforms.conf?

splunkIT — Mon, 28 Sep 2020 14:03:49 GMT

According to http://docs.splunk.com/Documentation/Splunk/5.0.3/Admin/Transformsconf

[accepted_keys]

Modifies Splunk's list of key names it considers valid when automatically checking your transforms for use of undocumented SOURCE_KEY or DEST_KEY values in index-time transformations.
By adding entries to [accepted_keys], you can tell Splunk that a key that is not documented is a key you intend to work for reasons that are valid in your environment / app / etc.
The 'name' element is simply used to disambiguate entries, similar to -class entries in props.conf. The name can be anything of your chosing, including a descriptive name for why you use the key.
The entire stanza defaults to not being present, causing all keys not documented just above to be flagged.

Re: What is [accepted_keys] in transforms.conf?

loudsong — Mon, 10 Jun 2013 22:05:21 GMT

I did see that documentation. I guess I was hoping for a bit more clarity with perhaps an example on how one might put this functionality to work.

Re: What is [accepted_keys] in transforms.conf?

loudsong — Mon, 10 Jun 2013 22:07:07 GMT

I am adding events via the REST API, with the receivers/simple endpoint. I'm also using the Python SDK. I want to add custom metadata to a group of events in the form of index fields. Much like when I use the API I can specify the host, source, and index as http query parameters when posting the data, I want to specify arbitrary http query parameters that I want splunk to turn into index fields.

POST ....blah/receivers/simple?source=myfile.txt&support_ticket=123456

Where I want splunk to treat the support_ticket query param as an index field to be applied to all events in the POST.

Re: What is [accepted_keys] in transforms.conf?

loudsong — Mon, 10 Jun 2013 22:08:05 GMT

I am adding events via the rest API, with the receivers/simple endpoint. I'm also using the Python SDK. I want to add custom metadata to a group of events in the form of index fields. Much like when I use the API I can specify the host, source, and index as http query parameters when posting the data, I want to specify arbitrary http query parameters that I want splunk to turn into index fields.

POST ....blah/receivers/simple?source=myfile.txt&support_ticket=123456

Where i want splunk to treat the support_ticket query param as an index field to be applied to all events in the POST.

Re: What is [accepted_keys] in transforms.conf?

splunkIT — Mon, 10 Jun 2013 22:30:30 GMT

Here is an example of the [accepted_keys] usage:

http://splunk-base.splunk.com/answers/90930/upgraded-to-splunk-503-and-noticing-undocumented-key-used-in-transformsconf-messages-during-startup