SplunkCIMFields

Convert Splunk CIM Fields Dynamic Into Fields Value.

Type

python

Pack

SplunkCIMFields

Source

import re

import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401

args = demisto.args()
inc = args.get("inc")
data = args.get("value")


def splunk_cim_fields(match):
    return data.replace("$" + match + "$", inc.get(match))


matches = re.findall(r"\$([^\$]*)\$", data)

for match in matches:
    data = splunk_cim_fields(match)

return_results(data)

README