SA-cim_validator: How to write an eval expression to convert and validate field values like /pts/0, /pts/1...?

[bagarwal]

Hello,

I want to write an expression that converts values like /pts/0, /pts/1, /dev/pts/0 ... and so on to an expected value. Right now, CIM validator only considers expected values such as cron, ssh for the field app. Refer to the screenshot below. If anyone can help me, thanks in advance.

[javiergn · Accepted solution]

What sort of conversion did you have in mind?

In any case you probably want something like:

eval app = case (
    match(app, "/pts/"), "ssh",
    match(app, "something else"), "cron",
    1 == 1, app
)

EDIT to include the final answer

I haven't used that CIM validator, I would normally use this other app: https://splunkbase.splunk.com/app/1621/

In any case, it seems the one you are using about has the following regex to identify what is a valid app and yours is not because it contains slashes:

^[\w:\-]+$

See this: https://github.com/hire-vladimir/SA-cim_validator/blob/master/lookups/cim_validator_field_regex.csv

Take a look at the CIM definition for the field app. There are no expected values I'm afraid.

http://docs.splunk.com/Documentation/CIM/latest/User/Authentication

In summary, if you want to be compliant with your app you could try removing those slashes or replacing them with something else:

| eval app = replace(app, "/", "")

[bagarwal]

Thank You so much for your response. I simply want that the value /pts/0, /pts/1, and so on should be considered as expected value as per CIM data model so can have 100 % CIM compliance for this field.

[javiergn]

I haven't used that CIM validator, I would normally used this other app: https://splunkbase.splunk.com/app/1621/

In any case, it seems the one you are using about has the following regex to identify what is a valid app and yours is not because it contains slashes:

^[\w:\-]+$

See this: https://github.com/hire-vladimir/SA-cim_validator/blob/master/lookups/cim_validator_field_regex.csv

Take a look at the CIM definition for the field app. There are no expected values I'm afraid.

http://docs.splunk.com/Documentation/CIM/latest/User/Authentication

In summary, if you want to be compliant with your app you could try removing those slashes or replacing them with something else:

| eval app = replace(app, "/", "")

[bagarwal]

@javiergn: Thanks a lot!! It works perfectly..

[javiergn]

No worries. If you are happy with the comment please mark it as answered so that others can benefit from it.

Thanks,
J