Getting Data In

What is [accepted_keys] in transforms.conf?

loudsong
Explorer

I noticed that in Splunk 5.0.3, transforms.conf has a new section called [accepted_keys]. Does anyone have an example of how this can be used?

Tags (1)

loudsong
Explorer

I am adding events via the REST API, with the receivers/simple endpoint. I'm also using the Python SDK. I want to add custom metadata to a group of events in the form of index fields. Much like when I use the API I can specify the host, source, and index as http query parameters when posting the data, I want to specify arbitrary http query parameters that I want splunk to turn into index fields.

POST ....blah/receivers/simple?source=myfile.txt&support_ticket=123456

Where I want splunk to treat the support_ticket query param as an index field to be applied to all events in the POST.

0 Karma

splunkIT
Splunk Employee
Splunk Employee

According to http://docs.splunk.com/Documentation/Splunk/5.0.3/Admin/Transformsconf

[accepted_keys]

=

  • Modifies Splunk's list of key names it considers valid when automatically checking your transforms for use of undocumented SOURCE_KEY or DEST_KEY values in index-time transformations.
  • By adding entries to [accepted_keys], you can tell Splunk that a key that is not documented is a key you intend to work for reasons that are valid in your environment / app / etc.
  • The 'name' element is simply used to disambiguate entries, similar to -class entries in props.conf. The name can be anything of your chosing, including a descriptive name for why you use the key.
  • The entire stanza defaults to not being present, causing all keys not documented just above to be flagged.

splunkIT
Splunk Employee
Splunk Employee
0 Karma

loudsong
Explorer

I am adding events via the rest API, with the receivers/simple endpoint. I'm also using the Python SDK. I want to add custom metadata to a group of events in the form of index fields. Much like when I use the API I can specify the host, source, and index as http query parameters when posting the data, I want to specify arbitrary http query parameters that I want splunk to turn into index fields.

POST ....blah/receivers/simple?source=myfile.txt&support_ticket=123456

Where i want splunk to treat the support_ticket query param as an index field to be applied to all events in the POST.

0 Karma

loudsong
Explorer

I did see that documentation. I guess I was hoping for a bit more clarity with perhaps an example on how one might put this functionality to work.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...