Knowledge Management

What is the best way to assign multiple eventtypes to a field from a comma-separated list?

arkadyz1
Builder

Our input data has a field named conditions, which is comma-separated list. We wanted to assign eventtypes to the events according to the list inside. For example, conditions="WeightOK,TooBig" would result in the event having two eventtypes: WeightOK and TooBig.

What would be the most efficient way of doing it? I don't think we could just have an evaluated field in props.conf/transforms.conf called eventtypes, could we? Eventtypes are normally defined in eventtypes.conf. Would it work if we created a search-time calculated field, say, mv_conditions=split(conditions,",") and then used

[app-%mv_conditions%]
search = <our search>

in eventtypes.conf? And if yes, would it be efficient?

0 Karma
1 Solution

arkadyz1
Builder

After a lot of experiments, I found that we'll have to:
a) tokenize the conditions field with TOKENIZER = ([^,]+) in fields.conf
b) resort to have all known conditions converted to eventtypes individually like this:

[WeightOK]
search = conditions=WeightOK

etc.

We are still checking the performance, even though it must already be better than our former search = conditions=*WeightOK*

View solution in original post

0 Karma

arkadyz1
Builder

After a lot of experiments, I found that we'll have to:
a) tokenize the conditions field with TOKENIZER = ([^,]+) in fields.conf
b) resort to have all known conditions converted to eventtypes individually like this:

[WeightOK]
search = conditions=WeightOK

etc.

We are still checking the performance, even though it must already be better than our former search = conditions=*WeightOK*

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...