Eval and Workflows...

[Steve_Litras]

So I've created a couple workflow actions for interfacing with service-now. One of which is looking up the host in our CMDB. Unfortunately, we have a number of devices out there that don't reverse resolve (yeah, I know, we're working on it. :), so sometimes the host field is an IP address. Since the CMDB query in service now doesn't allow you to do "or" in the URL based queries (that I've been able to find), I've got two different workflows, one which executes the query with the argument:

Name=$host$

and the other with:

ip_address=$host$

I'd like to have a field created at search time, ala the following eval:

eval cmdbent=if(match(host,"\d+.\d+.\d+.\d+"), "ip_address", "name") . "=" . host

So really, I'd like to create a field containing "ip_address" if the host value matches the \d+.\d+.\d+.\d regex, but "name" otherwise. Can this be done with a regular transform instead of eval?

Thanks Steve

[southeringtonp · Accepted solution]

You'd need two transforms, but it's definitely doable.

In transforms.conf:

[cmdbent1]
SOURCE_KEY = host
REGEX = ^(\d+\.\d+\.\d+\.\d+)$
FORMAT = cmdbent::"ip_address"

[cmdbent2]
SOURCE_KEY = host
REGEX = (.)
FORMAT = cmdbent::"name"

In props.conf:

[yoursourcetype]
REPORT-cmdbent = cmdbent1, cmdbent2

By default, Splunk will not extract a value unless the destination field is empty -- since cmdbent1 is executed first, cmdbent2 acts as a fallback/default value.

If you want the transform to always apply, then leave out the sourcetype stanza header and place it at the top of props.conf. If it's not listed beneath a stanza header, it will be treated as a global setting.

[Steve_Litras]

Works perfectly! Thanks!