Getting Data In

Coalesce in transforms

knutsod
Path Finder

Hello,

I am working with some apache logs that can go through one or more proxies, when a request go through a proxy a X-forwarded-for header is added. The problem is that the apache logs show the client IP as the last address the request came from. The logs do however add the X-forwarded-for entries to the end of the log entry if they exist.

What I need to do is get the clientip field updated via transforms to the correct address so that the web analytics app gets the correct data. The following search shows an example of the goal.

index=weblogs
| rex field=other "^(?<first_forward>[0-9\.]+)"
| eval clientip=coalesce(first_forward, clientip)

The other field is already extracted and contains a comma separated list of the X-forwarded-for headers.

I see two options on how to solve this, unless there is some magic way to do evals in transforms/props.

1) I could create a regex to extract the values in transforms, but not sure how to coalesce them in transforms/props.

2) Create a macro that does the job, but then I would need to update every search in the app and this would make updating the app lame.

Any ideas?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...