Splunk Search

Replace placeholders in message templates with property values

nathanjr
Engager

We are importing structured logs stored as json lines in a text file. An example event:

{ "time": "...", "template": "User {Username} logged into {Application}", "Username": "John.Doe", "Application": "SomeApp" }

I am looking to render the template into a message property that would read "User John.Doe logged into SomeApp" by replacing the tokens with values from their respective properties.

The template and properties are dynamic, so I cannot hard code the property names in the regex. Is there a way to perform this rendering dynamically either during log ingestion or during search time?

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this:

| makeresults 
| eval _raw="{ \"time\": \"...\", \"template\": \"User {Username} logged into {Application}\", \"Username\": \"John.Doe\", \"Application\": \"SomeApp\" }"


| spath
| foreach *
    [| eval template=if("<<FIELD>>"="template",template,replace(template,"\{"."<<FIELD>>"."\}",<<FIELD>>))]

The first two lines just set up some dummy data.

View solution in original post

nathanjr
Engager

Thank you so much! 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this:

| makeresults 
| eval _raw="{ \"time\": \"...\", \"template\": \"User {Username} logged into {Application}\", \"Username\": \"John.Doe\", \"Application\": \"SomeApp\" }"


| spath
| foreach *
    [| eval template=if("<<FIELD>>"="template",template,replace(template,"\{"."<<FIELD>>"."\}",<<FIELD>>))]

The first two lines just set up some dummy data.

Get Updates on the Splunk Community!

Unlock New Opportunities with Splunk Education: Explore Our Latest Courses!

At Splunk Education, we’re dedicated to providing top-tier learning experiences that cater to every skill ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...