Knowledge Management

What is the best way to assign multiple eventtypes to a field from a comma-separated list?

arkadyz1
Builder

Our input data has a field named conditions, which is comma-separated list. We wanted to assign eventtypes to the events according to the list inside. For example, conditions="WeightOK,TooBig" would result in the event having two eventtypes: WeightOK and TooBig.

What would be the most efficient way of doing it? I don't think we could just have an evaluated field in props.conf/transforms.conf called eventtypes, could we? Eventtypes are normally defined in eventtypes.conf. Would it work if we created a search-time calculated field, say, mv_conditions=split(conditions,",") and then used

[app-%mv_conditions%]
search = <our search>

in eventtypes.conf? And if yes, would it be efficient?

0 Karma
1 Solution

arkadyz1
Builder

After a lot of experiments, I found that we'll have to:
a) tokenize the conditions field with TOKENIZER = ([^,]+) in fields.conf
b) resort to have all known conditions converted to eventtypes individually like this:

[WeightOK]
search = conditions=WeightOK

etc.

We are still checking the performance, even though it must already be better than our former search = conditions=*WeightOK*

View solution in original post

0 Karma

arkadyz1
Builder

After a lot of experiments, I found that we'll have to:
a) tokenize the conditions field with TOKENIZER = ([^,]+) in fields.conf
b) resort to have all known conditions converted to eventtypes individually like this:

[WeightOK]
search = conditions=WeightOK

etc.

We are still checking the performance, even though it must already be better than our former search = conditions=*WeightOK*

0 Karma
Get Updates on the Splunk Community!

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...