SplunkCIMFields

Convert Splunk CIM Fields Dynamic Into Fields Value.

Source

import re

import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401

args = demisto.args()
inc = args.get("inc")
data = args.get("value")


def splunk_cim_fields(match):
    return data.replace("$" + match + "$", inc.get(match))


matches = re.findall(r"\$([^\$]*)\$", data)

for match in matches:
    data = splunk_cim_fields(match)

return_results(data)

README

Convert Splunk CIM Fields Dynamic Into Fields Value

Script Data

Name	Description
Script Type	python3
Tags	transformer, string

Inputs

Argument Name	Description
value	Input string from incident.
inc	Incident field values from incident.

Outputs

There are no outputs for this script.