Is there a way to add a field from a REST Collector’s `Discover` phase to the collection results?
Is there a way to add a field from a REST Collector's `Discover` phase to the collection results? My Discover has metadata that I'd like to use to enrich the child records.
Answers
-
Hi. Here are few examples that show how to pass the variable from the Discover to the Collector:
0 -
For example, C.Encode.uri(`${sys_id}`)
0 -
Both examples use it in the URL to the collector. I'm wanting the events in response from the collector to include some fields from the corresponding discover event.
0 -
I'm thinking of something I can add in Processing Settings->Fields from the discovered response.
0 -
I see this option on the Script Collector .. but, I have not tried it with the Rest Collector .. it might be worth a try
0 -
Collect script: Script to perform data collections. Pass in tasks from the Discover script as `$CRIBL_COLLECT_ARG`
0 -
That reads like it is an environment parameter that is interpreted in the shell. Thanks for looking. Maybe I should request this feature?
0 -
I see that `__source` is returned as the URL that fed discovery, but other fields like ___discover_data_ could be helpful to include the effective portion of the response that fed into the final record(s).
0 -
<@U02GV62PH1B> there was a similar thread recently in <#CGCU5A18B|feature-request>, see https://cribl-community.slack.com/archives/CGCU5A18B/p1676993799242839|here - is that kind of what you're talking about?
0
