Knowledge Management

What is the best way to assign multiple eventtypes to a field from a comma-separated list?

arkadyz1
Builder

Our input data has a field named conditions, which is comma-separated list. We wanted to assign eventtypes to the events according to the list inside. For example, conditions="WeightOK,TooBig" would result in the event having two eventtypes: WeightOK and TooBig.

What would be the most efficient way of doing it? I don't think we could just have an evaluated field in props.conf/transforms.conf called eventtypes, could we? Eventtypes are normally defined in eventtypes.conf. Would it work if we created a search-time calculated field, say, mv_conditions=split(conditions,",") and then used

[app-%mv_conditions%]
search = <our search>

in eventtypes.conf? And if yes, would it be efficient?

0 Karma
1 Solution

arkadyz1
Builder

After a lot of experiments, I found that we'll have to:
a) tokenize the conditions field with TOKENIZER = ([^,]+) in fields.conf
b) resort to have all known conditions converted to eventtypes individually like this:

[WeightOK]
search = conditions=WeightOK

etc.

We are still checking the performance, even though it must already be better than our former search = conditions=*WeightOK*

View solution in original post

0 Karma

arkadyz1
Builder

After a lot of experiments, I found that we'll have to:
a) tokenize the conditions field with TOKENIZER = ([^,]+) in fields.conf
b) resort to have all known conditions converted to eventtypes individually like this:

[WeightOK]
search = conditions=WeightOK

etc.

We are still checking the performance, even though it must already be better than our former search = conditions=*WeightOK*

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...