Splunk Search

Can you do lookups on the (searchtime) auto-extracted fieldnames themselves?

dbergstr
New Member

I have SNMP logs that come in with a large variety of keyvalue pairs. The key side is translated at the trap level on the OS in order to have a human readable key. The problem is that the value side is just an integer (like an enum that references some possible set of values for that key). I have a lookup file that maps the fieldname to a human readable value/definition. Most of the keys all follow a similar part with a prefix to them being 'cpq'.

Is there any way to perform a lookup (auto or otherwise) on each of the actual field names that are auto-parsed during search time?

for example:
event line looks like:
CPQHOST-MIB::compaq Enterprise Specific Trap (CPQHOST-MIB::cpqHoMibHealthStatusArrayChangeTrap) Uptime: 178 days, 12:14:54.70
SNMPv2-MIB::sysName.0 = STRING: CPQHOST-MIB::cpqHoTrapFlags.0 = INTEGER: 4 CPQHOST-MIB::cpqHoMibHealthStatusArray.0 = Hex-STRING: 03 03 02 02 02 02 02 02 02 03 00 02 00 00 02 02
02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00

and in Splunk it auto-extracts the fieldnames

cpqHoTrapFlags_0 = 4
cpqHoMibHealthStatusArray_0 = 03 03 02 02 02 02 02 02 02 03 00 02 00 00 02 02 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Is there a way I can get Splunk to (auto)lookup all the field names that start with cpq for a definition in some lookup file? Or does this require more logic that would have to be taken care of in a modular inputs type thing?

0 Karma
Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...