topic Re: Replace placeholders in message templates with property values in Splunk Search

Replace placeholders in message templates with property values

nathanjr — Wed, 02 Jun 2021 20:30:35 GMT

We are importing structured logs stored as json lines in a text file. An example event:

{ "time": "...", "template": "User {Username} logged into {Application}", "Username": "John.Doe", "Application": "SomeApp" }

I am looking to render the template into a message property that would read "User John.Doe logged into SomeApp" by replacing the tokens with values from their respective properties.

The template and properties are dynamic, so I cannot hard code the property names in the regex. Is there a way to perform this rendering dynamically either during log ingestion or during search time?

Re: Replace placeholders in message templates with property values

ITWhisperer — Wed, 02 Jun 2021 20:47:35 GMT

Try something like this:

| makeresults | eval _raw="{ \"time\": \"...\", \"template\": \"User {Username} logged into {Application}\", \"Username\": \"John.Doe\", \"Application\": \"SomeApp\" }" | spath | foreach * [| eval template=if("<<FIELD>>"="template",template,replace(template,"\{"."<<FIELD>>"."\}",<<FIELD>>))]

The first two lines just set up some dummy data.

Re: Replace placeholders in message templates with property values

nathanjr — Wed, 02 Jun 2021 22:44:02 GMT

Thank you so much!