Getting Data In

What is [accepted_keys] in transforms.conf?

Explorer

I noticed that in Splunk 5.0.3, transforms.conf has a new section called [accepted_keys]. Does anyone have an example of how this can be used?

Tags (1)

Explorer

I am adding events via the REST API, with the receivers/simple endpoint. I'm also using the Python SDK. I want to add custom metadata to a group of events in the form of index fields. Much like when I use the API I can specify the host, source, and index as http query parameters when posting the data, I want to specify arbitrary http query parameters that I want splunk to turn into index fields.

POST ....blah/receivers/simple?source=myfile.txt&support_ticket=123456

Where I want splunk to treat the support_ticket query param as an index field to be applied to all events in the POST.

0 Karma

Splunk Employee
Splunk Employee

According to http://docs.splunk.com/Documentation/Splunk/5.0.3/Admin/Transformsconf

[accepted_keys]

=

  • Modifies Splunk's list of key names it considers valid when automatically checking your transforms for use of undocumented SOURCE_KEY or DEST_KEY values in index-time transformations.
  • By adding entries to [accepted_keys], you can tell Splunk that a key that is not documented is a key you intend to work for reasons that are valid in your environment / app / etc.
  • The 'name' element is simply used to disambiguate entries, similar to -class entries in props.conf. The name can be anything of your chosing, including a descriptive name for why you use the key.
  • The entire stanza defaults to not being present, causing all keys not documented just above to be flagged.

Splunk Employee
Splunk Employee
0 Karma

Explorer

I am adding events via the rest API, with the receivers/simple endpoint. I'm also using the Python SDK. I want to add custom metadata to a group of events in the form of index fields. Much like when I use the API I can specify the host, source, and index as http query parameters when posting the data, I want to specify arbitrary http query parameters that I want splunk to turn into index fields.

POST ....blah/receivers/simple?source=myfile.txt&support_ticket=123456

Where i want splunk to treat the support_ticket query param as an index field to be applied to all events in the POST.

0 Karma

Explorer

I did see that documentation. I guess I was hoping for a bit more clarity with perhaps an example on how one might put this functionality to work.

0 Karma