topic Re: HTTP ResponseCode transformation in Splunk Search

HTTP ResponseCode transformation

me74fhfd — Tue, 05 Jan 2021 09:30:50 GMT

Hi all,

I have a use case to transform gzipped binary portion of HTTP ResponseCode into readable content. Is this something that's possible to do, and if not what's the best workaround?
Example attached

Many thanks

Re: HTTP ResponseCode transformation

scelikok — Tue, 05 Jan 2021 15:10:35 GMT

Hi @me74fhfd,

You can have two workarounds below:

1- You can create a custom command that gets the ResponseCode field and outputs text into the same or an additional field. A simple python code will help to unzip the value. This will work on search time.

2- You can use scripted input for data input which will read file etc, and send unzipped/transformed data to Splunk. This will be index time operation.

First option will be easier since Splunk will handle all file monitor processes. You will deal only with a field, otherwise you will be responsible all file operations, monitoring file EOF etc.

If this reply helps you an upvote is appreciated.

Re: HTTP ResponseCode transformation

me74fhfd — Tue, 05 Jan 2021 16:42:37 GMT

Thanks for help. Can you please provide any link / example how that piece of code would look like and settings/config to apply it.

Re: HTTP ResponseCode transformation

scelikok — Tue, 05 Jan 2021 21:25:57 GMT

Hi @me74fhfd,

You can check below link regarding custom commands;

https://dev.splunk.com/enterprise/docs/devtools/customsearchcommands/