All Apps and Add-ons

Microsoft Office 365: Regex to route events based upon content


I need to look at the raw events coming in from Office 365- which is JSON formatted,
and then route them based upon the content.

I want to route them based upon the "Workload" field that is coming in. Has anyone done this?

Here's a sample of the field:

"Workload": "AzureActiveDirectory"}
0 Karma


You could use ingest-time eval, if you have Splunk 7.2+.


TRANSFORMS = o365index

transforms.conf option 1: manually choose index based on Workload field:

INGEST_EVAL = index=case(match(_raw,"\"Workload\":\s\"AzureActiveDirectory\"}"),"index1",match(_raw,"\"Workload\":\s\"Exchange\"}"),"index2",true(),"index3")

transforms.conf option 2: dynamically choose index based on Workload field, index will have same name as Workload (o365:exchange, o365:sharepoint, etc.)

0 Karma

Splunk Employee
Splunk Employee

Sounds spot on for transforms.conf. The spec file has an example:

REGEX = \"Workload\"\:
DEST_KEY = _MetaData:Index
FORMAT = VerboseIndex

This post route data to indexes based on fields provides more detail.

0 Karma
Get Updates on the Splunk Community!

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Tips & Tricks When Using Ingest Actions

Tune in to learn about:Large scale architecture when using Ingest ActionsRegEx performance considerations ...