Splunk Search

Substituting key values on raw text

responsys_cm
Builder

Let's say I have a CSV input with the following columns:  _raw,user,src_ip

The _raw event is:  "Accepted public key for user $user$ from $src_ip$"

Is there a way to replace $user$ and $src_ip$ in _raw with the values of the corresponding fields?

I tried using "foreach" and "rex" in sedcmd mode, but it doesn't look like rex understands <<FIELD>> and '<<FIELD>>'.  

Is there another way to do this?

Labels (1)
0 Karma

johnhuang
Motivator

Assuming you're running this during search time.

 

Quick and dirty:

 

| eval _raw="Accepted public key for user ".user." from ".src_ip

 

 

Dynamic:

 

| foreach user src_ip [eval _raw=replace(_raw, "\$<<FIELD>>\$", '<<FIELD>>')]

 

 

0 Karma
Get Updates on the Splunk Community!

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco &#43; Splunk! We’ve ...

Enterprise Security Content Update (ESCU) | New Releases

In April, the Splunk Threat Research Team had 2 releases of new security content via the Enterprise Security ...