All Apps and Add-ons

SA-cim_validator: How to write an eval expression to convert and validate field values like /pts/0, /pts/1...?

bagarwal
Path Finder

Hello,

I want to write an expression that converts values like /pts/0, /pts/1, /dev/pts/0 ... and so on to an expected value. Right now, CIM validator only considers expected values such as cron, ssh for the field app. Refer to the screenshot below. If anyone can help me, thanks in advance.

alt text

0 Karma
1 Solution

javiergn
Super Champion

What sort of conversion did you have in mind?

In any case you probably want something like:

eval app = case (
    match(app, "/pts/"), "ssh",
    match(app, "something else"), "cron",
    1 == 1, app
)

EDIT to include the final answer

I haven't used that CIM validator, I would normally use this other app: https://splunkbase.splunk.com/app/1621/

In any case, it seems the one you are using about has the following regex to identify what is a valid app and yours is not because it contains slashes:

^[\w:\-]+$

See this: https://github.com/hire-vladimir/SA-cim_validator/blob/master/lookups/cim_validator_field_regex.csv

Take a look at the CIM definition for the field app. There are no expected values I'm afraid.

http://docs.splunk.com/Documentation/CIM/latest/User/Authentication

In summary, if you want to be compliant with your app you could try removing those slashes or replacing them with something else:

| eval app = replace(app, "/", "")

View solution in original post

0 Karma

javiergn
Super Champion

What sort of conversion did you have in mind?

In any case you probably want something like:

eval app = case (
    match(app, "/pts/"), "ssh",
    match(app, "something else"), "cron",
    1 == 1, app
)

EDIT to include the final answer

I haven't used that CIM validator, I would normally use this other app: https://splunkbase.splunk.com/app/1621/

In any case, it seems the one you are using about has the following regex to identify what is a valid app and yours is not because it contains slashes:

^[\w:\-]+$

See this: https://github.com/hire-vladimir/SA-cim_validator/blob/master/lookups/cim_validator_field_regex.csv

Take a look at the CIM definition for the field app. There are no expected values I'm afraid.

http://docs.splunk.com/Documentation/CIM/latest/User/Authentication

In summary, if you want to be compliant with your app you could try removing those slashes or replacing them with something else:

| eval app = replace(app, "/", "")
0 Karma

bagarwal
Path Finder

Thank You so much for your response. I simply want that the value /pts/0, /pts/1, and so on should be considered as expected value as per CIM data model so can have 100 % CIM compliance for this field.

0 Karma

javiergn
Super Champion

I haven't used that CIM validator, I would normally used this other app: https://splunkbase.splunk.com/app/1621/

In any case, it seems the one you are using about has the following regex to identify what is a valid app and yours is not because it contains slashes:

^[\w:\-]+$

See this: https://github.com/hire-vladimir/SA-cim_validator/blob/master/lookups/cim_validator_field_regex.csv

Take a look at the CIM definition for the field app. There are no expected values I'm afraid.

http://docs.splunk.com/Documentation/CIM/latest/User/Authentication

In summary, if you want to be compliant with your app you could try removing those slashes or replacing them with something else:

| eval app = replace(app, "/", "")

bagarwal
Path Finder

@javiergn: Thanks a lot!! It works perfectly..

0 Karma

javiergn
Super Champion

No worries. If you are happy with the comment please mark it as answered so that others can benefit from it.

Thanks,
J

0 Karma
Get Updates on the Splunk Community!

Splunk is Nurturing Tomorrow’s Cybersecurity Leaders Today

Meet Carol Wright. She leads the Splunk Academic Alliance program at Splunk. The Splunk Academic Alliance ...

Part 2: A Guide to Maximizing Splunk IT Service Intelligence

Welcome to the second segment of our guide. In Part 1, we covered the essentials of getting started with ITSI ...

Part 1: A Guide to Maximizing Splunk IT Service Intelligence

As modern IT environments continue to grow in complexity and speed, the ability to efficiently manage and ...