Knowledge Management

What is the best way to assign multiple eventtypes to a field from a comma-separated list?

arkadyz1
Builder

Our input data has a field named conditions, which is comma-separated list. We wanted to assign eventtypes to the events according to the list inside. For example, conditions="WeightOK,TooBig" would result in the event having two eventtypes: WeightOK and TooBig.

What would be the most efficient way of doing it? I don't think we could just have an evaluated field in props.conf/transforms.conf called eventtypes, could we? Eventtypes are normally defined in eventtypes.conf. Would it work if we created a search-time calculated field, say, mv_conditions=split(conditions,",") and then used

[app-%mv_conditions%]
search = <our search>

in eventtypes.conf? And if yes, would it be efficient?

0 Karma
1 Solution

arkadyz1
Builder

After a lot of experiments, I found that we'll have to:
a) tokenize the conditions field with TOKENIZER = ([^,]+) in fields.conf
b) resort to have all known conditions converted to eventtypes individually like this:

[WeightOK]
search = conditions=WeightOK

etc.

We are still checking the performance, even though it must already be better than our former search = conditions=*WeightOK*

View solution in original post

0 Karma

arkadyz1
Builder

After a lot of experiments, I found that we'll have to:
a) tokenize the conditions field with TOKENIZER = ([^,]+) in fields.conf
b) resort to have all known conditions converted to eventtypes individually like this:

[WeightOK]
search = conditions=WeightOK

etc.

We are still checking the performance, even though it must already be better than our former search = conditions=*WeightOK*

0 Karma
Get Updates on the Splunk Community!

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...