topic Re: Extract multiple fields without knowing their order in TRANSFORMS in Splunk Search

Extract multiple fields without knowing their order in TRANSFORMS

ilya_resh — Wed, 30 Sep 2020 04:59:43 GMT

Hi,
I need to extract multiple fields (from events that are coming via HEC) and assign an index based on the concatenated values.
(I know that you can assign index per HEC token, but let's assume that all the events are coming with the same token)
Example payload

{
    "sourcetype": "hec:generic",
    "event": {
        "platform": "platform01",
        "service": "service02",
        "env": "npd",
        "type": "alert",
        "test": "true",
        "message": "TEST HEC 040"
    }
}

i've figured out how to do it if I know the order
props.conf

[hec:generic]
TRANSFORMS-index_selector = index_selector

transforms.conf

[index_selector]
REGEX =  platform"\s?:\s?"(?P<platform>\w+)",\n\s*"service"\s?:\s?"(?P<service>\w+)",\n\s*"env"\s?:\s?"(?P<env>\w+)
DEST_KEY = _MetaData:Index
FORMAT   = $1_$2_$3

But what if I don't know the order of the platform , service and env fields?
Any suggestions?
Can I somehow have 3 separate REGEX lines?
Tried below

    REGEX =  platform"\s?:\s?"(?P<platform>\w+)
    REGEX =  service"\s?:\s?"(?P<service>\w+)
    REGEX =  env"\s?:\s?"(?P<env>\w+)
    DEST_KEY = _MetaData:Index
    FORMAT   = $1_$2_$3

and the result it just picks up the last REGEX, so basically it tries to assign "npd_$2_$3" to index

Re: Extract multiple fields without knowing their order in TRANSFORMS

to4kawa — Fri, 10 Apr 2020 22:12:34 GMT

you JSON is valid

props.conf

[hec:generic]
TRANCATE = 0
DATETIME_CONFIG = CURRENT
SEDCMD-remove = s/^.*?fields\":\s({.*?}).*/\1/
INDEXED_EXTRACTIONS = json
KV_MODE = none
TRANSFORMS-index_selector = index_selector

Splunk default: KV_MODE = auto
json is extracted appropriate.

Re: Extract multiple fields without knowing their order in TRANSFORMS

ilya_resh — Sun, 12 Apr 2020 20:48:27 GMT

@to4kawa , it is a valid JSON, but KV_MODE is used for search-time field extractions only.
In my case I need to use the JSON fields during indexing to actually decide which index will be used to store the events (but not save them as indexed fields)

Re: Extract multiple fields without knowing their order in TRANSFORMS

to4kawa — Wed, 30 Sep 2020 04:56:21 GMT

try

INDEXED_EXTRACTIONS = json
KV_MODE = none
on props.conf

Re: Extract multiple fields without knowing their order in TRANSFORMS

ilya_resh — Tue, 14 Apr 2020 21:39:46 GMT

I didn't want to have all the JSON fields been indexed.
Here is what I came up with (still will need to asses performance impact)
When sending HEC add fields portion
So now the payload looks like that

{
    "sourcetype": "hec:generic",
    "fields": {
        "platform": "platform01",
        "service": "service02",
        "env": "npd"
    },
    "event": {
        "type": "alert",
        "test": "true",
        "message": "TEST HEC 046"
    }
}

props.conf

[hec:generic]
TRANSFORMS-index_selector = index_selector
TRANSFORMS-remove_hec_meta = meta_remover

transforms.conf

[index_selector]
INGEST_EVAL = index=platform . "_" . service . "_" . env

[meta_remover]
INGEST_EVAL = env:=null(),  service:=null(),  platform:=null()

The meta_remover is optional in case one doesn't want to index fields that were used on selecting the index