Skip to main content
Question

Is there a way to add a field from a REST Collector’s `Discover` phase to the collection results?

  • March 11, 2025
  • 10 replies
  • 25 views

Is there a way to add a field from a REST Collector's `Discover` phase to the collection results? My Discover has metadata that I'd like to use to enrich the child records.

10 replies

Raanan Dagan
  • Employee
  • March 11, 2025

Hi. Here are few examples that show how to pass the variable from the Discover to the Collector:


Raanan Dagan
  • Employee
  • March 11, 2025

Raanan Dagan
  • Employee
  • March 11, 2025

For example,C.Encode.uri(`${sys_id}`)


  • Author
  • Employee
  • March 11, 2025

Both examples use it in the URL to the collector. I'm wanting the events in response from the collector to include some fields from the corresponding discover event.


  • Author
  • Employee
  • March 11, 2025

I'm thinking of something I can add in Processing Settings->Fields from the discovered response.


Raanan Dagan
  • Employee
  • March 11, 2025

I see this option on the Script Collector .. but, I have not tried it with the Rest Collector .. it might be worth a try


Raanan Dagan
  • Employee
  • March 11, 2025

Collect script: Script to perform data collections. Pass in tasks from the Discover script as `$CRIBL_COLLECT_ARG`


  • Author
  • Employee
  • March 11, 2025

That reads like it is an environment parameter that is interpreted in the shell. Thanks for looking. Maybe I should request this feature?


<@U02GV62PH1B&gt; there was a similar thread recently in <#CGCU5A18B|feature-request>, see https://cribl-community.slack.com/archives/CGCU5A18B/p1676993799242839|here - is that kind of what you're talking about?


  • Author
  • Employee
  • March 11, 2025

I see that `__source` is returned as the URL that fed discovery, but other fields like ___discover_data_ could be helpful to include the effective portion of the response that fed into the final record(s).