Yes, you can achieve this by using a Python script as a scripted input in Splunk. You can read the data using Python, perform the modifications as you described (decoding the JSON, updating the dicti...
See more...
Yes, you can achieve this by using a Python script as a scripted input in Splunk. You can read the data using Python, perform the modifications as you described (decoding the JSON, updating the dictionary, and re-encoding it), and output the modified data. Here's how it works: Create a Python Script: Read the incoming data. Apply the necessary transformations. Print the modified JSON to standard output (stdout). Configure Scripted Input in Splunk: Go to Settings > Data Inputs > Scripts. Add a new scripted input and select your Python script. Set a cron schedule for when the script should run. The script will run at the configured intervals, fetch the data, apply your changes, and send the transformed data to Splunk for indexing. Important Consideration: The main limitation is that data ingestion will depend on the cron schedule of the scripted input, so real-time or very frequent data processing might not be achievable. Adjust the schedule as needed based on your data update frequency.