Splunk Search

HTTP ResponseCode transformation

me74fhfd
Path Finder

Hi all,

I have a use case to transform gzipped binary portion of HTTP ResponseCode into readable content. Is this something that's possible to do, and if not what's the best workaround?
Example attached

Many thanks

Labels (2)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @me74fhfd,

You can check below link regarding custom commands;

https://dev.splunk.com/enterprise/docs/devtools/customsearchcommands/

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

scelikok
SplunkTrust
SplunkTrust

Hi @me74fhfd,

You can check below link regarding custom commands;

https://dev.splunk.com/enterprise/docs/devtools/customsearchcommands/

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.

me74fhfd
Path Finder

Thanks for help. Can you please provide any link / example how that piece of code would look like and settings/config to apply it.

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @me74fhfd,

You can have two workarounds below:

1- You can create a custom command that gets the ResponseCode field and outputs text into the same or an additional field. A simple python code will help to unzip the value. This will work on search time.

2- You can use scripted input for data input which will read file etc, and send unzipped/transformed data to Splunk. This will be index time operation.

First option will be easier since Splunk will handle all file monitor processes. You will deal only with a field, otherwise you will be responsible all file operations, monitoring file EOF etc. 

 

If this reply helps you an upvote is appreciated.

If this reply helps you an upvote and "Accept as Solution" is appreciated.
Get Updates on the Splunk Community!

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Splunk App for Anomaly Detection End of Life Announcement

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...