Splunk Search

Extract multiple fields without knowing their order in TRANSFORMS

ilya_resh
Engager

Hi,
I need to extract multiple fields (from events that are coming via HEC) and assign an index based on the concatenated values.
(I know that you can assign index per HEC token, but let's assume that all the events are coming with the same token)
Example payload

{
    "sourcetype": "hec:generic",
    "event": {
        "platform": "platform01",
        "service": "service02",
        "env": "npd",
        "type": "alert",
        "test": "true",
        "message": "TEST HEC 040"
    }
}

i've figured out how to do it if I know the order
props.conf

[hec:generic]
TRANSFORMS-index_selector = index_selector

transforms.conf

[index_selector]
REGEX =  platform"\s?:\s?"(?P<platform>\w+)",\n\s*"service"\s?:\s?"(?P<service>\w+)",\n\s*"env"\s?:\s?"(?P<env>\w+)
DEST_KEY = _MetaData:Index
FORMAT   = $1_$2_$3

But what if I don't know the order of the platform , service and env fields?
Any suggestions?
Can I somehow have 3 separate REGEX lines?
Tried below

    REGEX =  platform"\s?:\s?"(?P<platform>\w+)
    REGEX =  service"\s?:\s?"(?P<service>\w+)
    REGEX =  env"\s?:\s?"(?P<env>\w+)
    DEST_KEY = _MetaData:Index
    FORMAT   = $1_$2_$3

and the result it just picks up the last REGEX, so basically it tries to assign "npd_$2_$3" to index

0 Karma

ilya_resh
Engager

I didn't want to have all the JSON fields been indexed.
Here is what I came up with (still will need to asses performance impact)
When sending HEC add fields portion
So now the payload looks like that

{
    "sourcetype": "hec:generic",
    "fields": {
        "platform": "platform01",
        "service": "service02",
        "env": "npd"
    },
    "event": {
        "type": "alert",
        "test": "true",
        "message": "TEST HEC 046"
    }
}

props.conf

[hec:generic]
TRANSFORMS-index_selector = index_selector
TRANSFORMS-remove_hec_meta = meta_remover

transforms.conf

[index_selector]
INGEST_EVAL = index=platform . "_" . service . "_" . env

[meta_remover]
INGEST_EVAL = env:=null(),  service:=null(),  platform:=null()

The meta_remover is optional in case one doesn't want to index fields that were used on selecting the index

0 Karma

to4kawa
Ultra Champion

you JSON is valid

props.conf

[hec:generic]
TRANCATE = 0
DATETIME_CONFIG = CURRENT
SEDCMD-remove = s/^.*?fields\":\s({.*?}).*/\1/
INDEXED_EXTRACTIONS = json
KV_MODE = none
TRANSFORMS-index_selector = index_selector

Splunk default: KV_MODE = auto
json is extracted appropriate.

0 Karma

ilya_resh
Engager

@to4kawa , it is a valid JSON, but KV_MODE is used for search-time field extractions only.
In my case I need to use the JSON fields during indexing to actually decide which index will be used to store the events (but not save them as indexed fields)

0 Karma

to4kawa
Ultra Champion

try

INDEXED_EXTRACTIONS = json
KV_MODE = none
on props.conf

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...