topic adding lookup or eval to transforms.conf in Splunk Search

adding lookup or eval to transforms.conf

fk319 — Tue, 08 Feb 2011 23:10:11 GMT

I would like to do an eval on every log entry, from a certian sourcetype. In this case I have a real number that I would like to quantize.

I also have a series of IPs that I would like to group by location. I am using a lookup at search, but I am only interested one or two locations for a search. Some of the IP ranges are /24, so I would also like to use wildcards.

I would like to make these changes when the log is loaded and not at search time so that I can search by location. Do I do this in transforms.conf? or is there another location?

Re: adding lookup or eval to transforms.conf

bwooden — Wed, 09 Feb 2011 06:41:53 GMT

You can not automatically call an eval out of the box using transforms.conf. You could create a macro though to minimize your typing. Instead of typing

... | eval some_var=<some eval opeartion>

you would type

... `macro_name`

Wildcards are not currently supported in lookups but you do have a few options.

You can create a scripted input to do it.
You can use event types.
You can leverage the search language (note: the below example would need to be updated for different mask bits)

... | rex field=ip "(?\d{1,3}.\d{1,3}.\d{1,3}.)" | strcat cidr_test "0/24" cidr_test | eval cidr=if(cidrmatch(cidr_test,ip),cidr_test,null) | where isnotnull(cidr) | lookup cidr OUTPUT location | search location="home_office"

Re: adding lookup or eval to transforms.conf

gkanapathy — Wed, 09 Feb 2011 06:43:15 GMT

You can not do this at index time (except by preprocessing your data before it even gets to Splunk).

You can configure automatic lookups that execute a script that can do whatever operations you need on the incoming data however.