So I've created a couple workflow actions for interfacing with service-now. One of which is looking up the host in our CMDB. Unfortunately, we have a number of devices out there that don't reverse resolve (yeah, I know, we're working on it. :), so sometimes the host field is an IP address. Since the CMDB query in service now doesn't allow you to do "or" in the URL based queries (that I've been able to find), I've got two different workflows, one which executes the query with the argument:
Name=$host$
and the other with:
ip_address=$host$
I'd like to have a field created at search time, ala the following eval:
eval cmdbent=if(match(host,"\d+.\d+.\d+.\d+"), "ip_address", "name") . "=" . host
So really, I'd like to create a field containing "ip_address" if the host value matches the \d+.\d+.\d+.\d regex, but "name" otherwise. Can this be done with a regular transform instead of eval?
Thanks Steve
You'd need two transforms, but it's definitely doable.
In transforms.conf:
[cmdbent1]
SOURCE_KEY = host
REGEX = ^(\d+\.\d+\.\d+\.\d+)$
FORMAT = cmdbent::"ip_address"
[cmdbent2]
SOURCE_KEY = host
REGEX = (.)
FORMAT = cmdbent::"name"
In props.conf:
[yoursourcetype]
REPORT-cmdbent = cmdbent1, cmdbent2
By default, Splunk will not extract a value unless the destination field is empty -- since cmdbent1
is executed first, cmdbent2
acts as a fallback/default value.
If you want the transform to always apply, then leave out the sourcetype stanza header and place it at the top of props.conf. If it's not listed beneath a stanza header, it will be treated as a global setting.
You'd need two transforms, but it's definitely doable.
In transforms.conf:
[cmdbent1]
SOURCE_KEY = host
REGEX = ^(\d+\.\d+\.\d+\.\d+)$
FORMAT = cmdbent::"ip_address"
[cmdbent2]
SOURCE_KEY = host
REGEX = (.)
FORMAT = cmdbent::"name"
In props.conf:
[yoursourcetype]
REPORT-cmdbent = cmdbent1, cmdbent2
By default, Splunk will not extract a value unless the destination field is empty -- since cmdbent1
is executed first, cmdbent2
acts as a fallback/default value.
If you want the transform to always apply, then leave out the sourcetype stanza header and place it at the top of props.conf. If it's not listed beneath a stanza header, it will be treated as a global setting.
Works perfectly! Thanks!