Splunk Search

HTTP ResponseCode transformation

me74fhfd
Path Finder

Hi all,

I have a use case to transform gzipped binary portion of HTTP ResponseCode into readable content. Is this something that's possible to do, and if not what's the best workaround?
Example attached

Many thanks

Labels (2)
0 Karma
1 Solution

scelikok
Champion

Hi @me74fhfd,

You can check below link regarding custom commands;

https://dev.splunk.com/enterprise/docs/devtools/customsearchcommands/

 

If this reply helps you an upvote is appreciated.

View solution in original post

scelikok
Champion

Hi @me74fhfd,

You can check below link regarding custom commands;

https://dev.splunk.com/enterprise/docs/devtools/customsearchcommands/

 

If this reply helps you an upvote is appreciated.

View solution in original post

me74fhfd
Path Finder

Thanks for help. Can you please provide any link / example how that piece of code would look like and settings/config to apply it.

0 Karma

scelikok
Champion

Hi @me74fhfd,

You can have two workarounds below:

1- You can create a custom command that gets the ResponseCode field and outputs text into the same or an additional field. A simple python code will help to unzip the value. This will work on search time.

2- You can use scripted input for data input which will read file etc, and send unzipped/transformed data to Splunk. This will be index time operation.

First option will be easier since Splunk will handle all file monitor processes. You will deal only with a field, otherwise you will be responsible all file operations, monitoring file EOF etc. 

 

If this reply helps you an upvote is appreciated.

If this reply helps you an upvote is appreciated.