侧边栏壁纸
  • 累计撰写 72 篇文章
  • 累计创建 36 个标签
  • 累计收到 8 条评论

目 录CONTENT

文章目录

创建Splunk自定义命令实现unicode转中文功能

散漫的老何
2020-12-30 / 0 评论 / 0 点赞 / 459 阅读 / 276 字 / 正在检测是否收录...
温馨提示:
本文最后更新于 2022-05-26,若内容或图片失效,请留言反馈。部分素材来自网络,若不小心影响到您的利益,请联系我们删除。

说明

创建 Splunk 自定义命令实现unicode转中文功能
需要结合Splunklib进行使用
Splunklib 下载地址

使用方法

| eval unicode field=需要转换的字段

Python 代码


#!/usr/bin/python
# coding:utf-8

import sys
import logging
import re
from splunklib.searchcommands import dispatch, StreamingCommand, Configuration, Option, validators


@Configuration()
class unicode(StreamingCommand):
    # 创建log文件配置
    logging.basicConfig(level=logging.DEBUG,
                        format='%(asctime)s %(filename)s[line:%(lineno)d] %(levelname)s %(message)s',
                        datefmt='%a, %d %b %Y %H:%M:%S',
                        filename='nuicode.log',
                        filemode='a')

    field = Option(name='field', require=True)
    def stream(self, records):
        logging.debug(self.field)
        if self.field != None:
            for record in records:
                subject = record[self.field]
                # record[self.field] = subject.encode('utf-8').decode('unicode_escape')
                record[self.field] = re.sub(r'(\\u[\s\S]{4})',lambda x:x.group(1).encode("utf-8").decode("unicode-escape"),subject)
                # logging.debug(record)
                yield record


dispatch(unicode, sys.argv, sys.stdin, sys.stdout, __name__)

local/commands.conf

[unicode]
filename = unicode.py
supports_getinfo = true
supports_rawargs = true
outputheader = true

local/searchbnf.conf

[unicode-command]
syntax      = subjectdecode field=<string> ?
shortdesc   = Converts Unicode to Chinese
description = Converts Unicode to Chinese \i\\
              "field"   - specify the field containing the data to encode or decode.\i\\

comment1 = decode the content of the field ab and store the results in a new field.
example1 = | unicode field="ab"
0
广告 广告

评论区