What is [accepted_keys] in transforms.conf?

[loudsong]

I noticed that in Splunk 5.0.3, transforms.conf has a new section called [accepted_keys]. Does anyone have an example of how this can be used?

[loudsong]

I am adding events via the REST API, with the receivers/simple endpoint. I'm also using the Python SDK. I want to add custom metadata to a group of events in the form of index fields. Much like when I use the API I can specify the host, source, and index as http query parameters when posting the data, I want to specify arbitrary http query parameters that I want splunk to turn into index fields.

POST ....blah/receivers/simple?source=myfile.txt&support_ticket=123456

Where I want splunk to treat the support_ticket query param as an index field to be applied to all events in the POST.

[splunkIT]

According to http://docs.splunk.com/Documentation/Splunk/5.0.3/Admin/Transformsconf

[accepted_keys]

=

• Modifies Splunk's list of key names it considers valid when automatically checking your transforms for use of undocumented SOURCE_KEY or DEST_KEY values in index-time transformations.
• By adding entries to [accepted_keys], you can tell Splunk that a key that is not documented is a key you intend to work for reasons that are valid in your environment / app / etc.
• The 'name' element is simply used to disambiguate entries, similar to -class entries in props.conf. The name can be anything of your chosing, including a descriptive name for why you use the key.
• The entire stanza defaults to not being present, causing all keys not documented just above to be flagged.

[splunkIT]

Here is an example of the [accepted_keys] usage:

http://splunk-base.splunk.com/answers/90930/upgraded-to-splunk-503-and-noticing-undocumented-key-use...

[loudsong]

I am adding events via the rest API, with the receivers/simple endpoint. I'm also using the Python SDK. I want to add custom metadata to a group of events in the form of index fields. Much like when I use the API I can specify the host, source, and index as http query parameters when posting the data, I want to specify arbitrary http query parameters that I want splunk to turn into index fields.

POST ....blah/receivers/simple?source=myfile.txt&support_ticket=123456

Where i want splunk to treat the support_ticket query param as an index field to be applied to all events in the POST.

[loudsong]

I did see that documentation. I guess I was hoping for a bit more clarity with perhaps an example on how one might put this functionality to work.