topic Re: Substituting key values on raw text in Splunk Search

Substituting key values on raw text

responsys_cm — Wed, 02 Feb 2022 00:22:30 GMT

Let's say I have a CSV input with the following columns: _raw,user,src_ip

The _raw event is: "Accepted public key for user $user$ from $src_ip$"

Is there a way to replace $user$ and $src_ip$ in _raw with the values of the corresponding fields?

I tried using "foreach" and "rex" in sedcmd mode, but it doesn't look like rex understands <<FIELD>> and '<<FIELD>>'.

Is there another way to do this?

Re: Substituting key values on raw text

johnhuang — Wed, 02 Feb 2022 02:10:25 GMT

Assuming you're running this during search time.

Quick and dirty:

| eval _raw="Accepted public key for user ".user." from ".src_ip

Dynamic:

| foreach user src_ip [eval _raw=replace(_raw, "\$<<FIELD>>\$", '<<FIELD>>')]