Splunk Search

Extracting a multivalue key-value pair to multivalue field for lookup

egrzeszczak
Loves-to-Learn Everything

Hello,

As I want to get my email events CIM compliant, I have trouble parsing a "disposition" key-value pair.

Example:

Having an event:

 

date=2024-01-09 time=11:59:43.258 device_id=XXXXXXXXXXXXXX log_id=0200012329 type=statistics pri=information session_id="4XXXXXXXXXXX-4XXXXXXXXXXXXX" client_name="example.com" disposition="Modify Subject;Insert Disclaimer;Defer Disposition" classifier="Data Loss Prevention" message_length="94756" subject="Test subject" message_id="xxxxxxxxxxxxxxxxxxxx@example.com" recv_time="" notif_delay="0" scan_time="0.186489" xfer_time="0.002166" srcfolder="" read_status="

 

I have disposition field extracted at search-time with the value "Modify Subject;Insert Disclaimer;Defer Disposition"

Want I need to do is to separate the values into a multivalue field, and then use a lookup to determine the action.

Lookup file:

 

vendor_action,action
Accept,delivered
Reject,blocked
Add Header,delivered
Modify Subject,
Quarantine,quarantined
Discard,blocked
Replace,
Delay,
Rewrite,
Insert Disclaimer,
Defer Disposition,delivered
Disclaimer Body,delivered
Disclaimer Header,delivered
Defer,
Quarantine to Review,quarantined
Content Filter as Spam,
Encrypt,
Decrypt,
Alternate Host,
BCC,
Archive,
Customized repackage,
Repackage,
Notification,

 

In the end, the event should have a field named action, and the value should for this example be delivered

My props.conf:

 

[fortimail]
...
...
LOOKUP-action = fortimail_action_lookup.csv vendor_action as disposition OUTPUT action
REPORT-disposition = disposition_extraction

 

My transforms.conf:

 

[disposition_extraction]
SOURCE_KEY = disposition
DELIMS = ";"
MV_ADD = true

 

But eventually i just end up with the original value ("Modify Subject;Insert Disclaimer;Defer Disposition") and it doesn't get separated

What am I doing wrong?

Labels (3)
0 Karma

egrzeszczak
Loves-to-Learn Everything

After a while I solved my problem with a EVAL statement 🙂

My props.conf is now:

...
...
EVAL-disposition_split = split(disposition, ";")
LOOKUP-action = fortimail_action_lookup.csv vendor_action AS disposition_split OUTPUT action
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...