Extending Splunk - Implementing Splunk: Big Data Reporting and Development for Operational Intelligence - page 398

The following are notes about this configuration:
• fields_list is the list of fields that will be sent to the script and the list
of fields expected in the result
• fields_list must contain at least two fields or the script will fail silently
The script then looks as follows:
import sys
import re
from csv import DictReader
from csv import DictWriter
patterns = []
def add_pattern(pattern, section):
patterns.append((re.compile(pattern), section))
add_pattern('^/about/.*', 'about')
add_pattern('^/contact/.*', 'contact')
add_pattern('^/.*/.*', 'unknown_non_root')
add_pattern('^/.*', 'root')
add_pattern('.*', 'nomatch')
# return a section for this url
def lookup(url):
try:
for (pattern, section) in patterns:
if pattern.match(url):
return section
return ''
except:
return ''
#set up our reader
reader = DictReader(sys.stdin)
fields = reader.fieldnames
#set up our writer
writer = DictWriter(sys.stdout, fields)
writer.writeheader()