Splunk Dev

Ingest-time EVAL configuration

me74fhfd
Path Finder

Hi all, 

In this example I want to use existing field Request64 from index index_new and decode it on ingest-time to produce RequestD base64 decoded field in same index. Can you please suggest if following config is valid for this operation:

$ inputs.conf
[monitor:///$SPLUNK_DB/index_new/db]
index=index_new
sourcetype= ST_NEW_DATA

$ cat props.conf
[ST_NEW_DATA]
TRANSFORMS-b64 = Request_t

$ transforms.conf
[Request_t]
INGEST_EVAL = RequestD=base64 field=Request64 action=decode mode=replace suppress_error=True

$ fields.conf
[RequestD]
INDEXED = True

This is macro to decode data:
https://splunkbase.splunk.com/app/1922/#/details

This is dump of index metadata to find monitor path:
| rest /services/data/indexes

coldPath
$SPLUNK_DB/index_new/colddb
coldPath_expanded
/opt/org/splunk_data/splunk/index_new/colddb
homePath
$SPLUNK_DB/index_new/db
homePath_expanded
/opt/org/splunk_data/splunk/index_new/db
id
https://127.0.0.1:8089/servicesNS/nobody/search/data/indexes/index_new
summaryHomePath_expanded
/opt/org/splunk_data/splunk/index_new/summary
thawedPath
$SPLUNK_DB/index_new/thaweddb
tstatsHomePath_expanded
/opt/org/splunk_data/splunk/index_new/datamodel_summary

Labels (1)
0 Karma

me74fhfd
Path Finder

No thats not an option here, takes too much of CPU .

0 Karma

thambisetty
SplunkTrust
SplunkTrust

why can't you decode just at search time?

[ST_NEW_DATA]
EVAL-RequestD = urldecode(Request64)

 

————————————
If this helps, give a like below.
0 Karma
Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...