HTTP ResponseCode transformation

[me74fhfd]

Hi all,

I have a use case to transform gzipped binary portion of HTTP ResponseCode into readable content. Is this something that's possible to do, and if not what's the best workaround?
Example attached

Many thanks

[scelikok · Accepted solution]

Hi @me74fhfd,

You can check below link regarding custom commands;

https://dev.splunk.com/enterprise/docs/devtools/customsearchcommands/

[me74fhfd]

Thanks for help. Can you please provide any link / example how that piece of code would look like and settings/config to apply it.

[scelikok]

Hi @me74fhfd,

You can have two workarounds below:

1- You can create a custom command that gets the ResponseCode field and outputs text into the same or an additional field. A simple python code will help to unzip the value. This will work on search time.

2- You can use scripted input for data input which will read file etc, and send unzipped/transformed data to Splunk. This will be index time operation.

First option will be easier since Splunk will handle all file monitor processes. You will deal only with a field, otherwise you will be responsible all file operations, monitoring file EOF etc. 

If this reply helps you an upvote is appreciated.