Edge Delta Splunk Mapper

Overview

The Splunk Mapper node applies mappings to create a new payload for the Splunk event endpoint. The output of this node can only be received by the Splunk output node. This node can ingest a log type or a custom type. There are some restrictions around what types of values can populate certain fields, for example the “event” field of the Splunk payload can only take string values, json strings, and json/maps.

Most of the fields in the schema can be customized, except “event” and “index”. If not customized, it will use the default value:

• Time: item["timestamp"]
• Host: item["resource"]["host.name"]
• Source: item["resource"]["__src_name"]
• Sourcetype: item["resource"]["src_type"]
• Event: item["body"]
• Fields: item["attributes"]
• Index: none

If the specified field is missing from the incoming item, an empty string will be used as default value.

Example Configuration

nodes:
  - name: splunk_payload_mapping_example
    type: splunk_mapper
    splunk_event: item["body"]
    splunk_index: "edgedelta"
    splunk_fields: item["attributes"]

Example Input log

{
    "timestamp": "1581452773000000789",
    "body": "Failed to do something",
    "resource": {
      "host.name": "host-1",
      "ed.tag": "test-config",
      "ed.org.id": "0481a213-....",
      "__src_name": "source_name",
      "src_type": "K8s",
      "__logical_source": "logical_source",
      "__short_src_name": "short_source_name",
      "__group_name": "group_name",
      "k8s.namespace.name": "edgedelta",
      "k8s.pod.name": "api-deployment-d79fab72249c",
      "k8s.container.name": "echo:latest",
      "k8s.labels.app": "my-api",
    },
    "type": "log",
    "attributes": {
        "pod_id":"api-deployment-d79fab72249c-vtq9x",
        "instance_id":"i-1234567890abcdef0",
        "instance_name":"test-name",
        "parsed": {
          "timestamp": "2023/07/11 09:40:21",
          "msg": "Failed to do something",
        },
        "original_timestamp": "2023/07/11 09:40:21",
    }
}

Example Output

{
  "event": "Failed to do something",
  "time": "1581452773000000789",
  "host": "host-1",
  "source": "source_name",
  "sourcetype": "K8s",
  "index": "edgedelta",
  "fields": {
        "pod_id":"api-deployment-d79fab72249c-vtq9x",
        "instance_id":"i-1234567890abcdef0",
        "instance_name":"test-name",
        "parsed": {
          "timestamp": "2023/07/11 09:40:21",
          "msg": "Failed to do something",
        },
        "original_timestamp": "2023/07/11 09:40:21",
    },
}

Required Parameters

name

A descriptive name for the node. This is the name that will appear in Visual Pipelines and you can reference this node in the yaml using the name. It must be unique across all nodes. It is a yaml list element so it begins with a - and a space followed by the string. It is a required parameter for all nodes.

nodes:
  - name: <node name>
    type: <node type>

type: splunk_mapper

The type parameter specifies the type of node being configured. It is specified as a string from a closed list of node types. It is a required parameter.

nodes:
  - name: <node name>
    type: <node type>

splunk_event

The splunk_event parameter defines the event field of the Splunk payload from the given input item. It is specified with CEL and you can use CEL macros. It is required.

nodes:
  - name: splunk_payload_mapping_example
    type: splunk_mapper
    splunk_event: item["body"]

splunk_source

The splunk_source parameter defines the source field of the Splunk payload from the given input item. It is specified with CEL and you can use CEL macros. It is required.

nodes:
  - name: splunk_payload_mapping_example
    type: splunk_mapper
    splunk_source: item["resource"]["__src_name"]

splunk_source_type

The splunk_source_type parameter defines the sourcetype field of the Splunk payload from the given input item. It is specified as with CEL and you can use CEL macros. A source type is required.

nodes:
  - name: splunk_payload_mapping_example
    type: splunk_mapper
    splunk_source_type: item["resource"]["src_type"]

Optional Parameters

splunk_fields

The splunk_fields parameter defines fields in the Splunk payload from the given input item. It is specified with CEL and you can use CEL macros. It is optional.

nodes:
  - name: splunk_payload_mapping_example
    type: splunk_mapper
    splunk_fields: item["attributes"]

splunk_host

The splunk_host parameter defines the host field of the Splunk payload from the given input item. It is specified with CEL and you can use CEL macros. It is optional.

nodes:
  - name: splunk_payload_mapping_example
    type: splunk_mapper
    splunk_host: item["resource"]["host.name"]

splunk_index

The splunk_index parameter defines the index field of the Splunk payload from the given input item. It is specified with CEL and you can use CEL macros. It is optional.

nodes:
  - name: splunk_payload_mapping_example
    type: splunk_mapper
    splunk_index: <index>

splunk_time

The splunk_time parameter defines the “time” field of the Splunk payload from the given input item. It is specified with CEL and you can use CEL macros. It is optional.

nodes:
  - name: splunk_payload_mapping_example
    type: splunk_mapper
    splunk_time: item["timestamp"]