Hi Team,
I’m working on an SNMP trap pipeline where:
Input event has fields like trap_name and trap_varbind_apSysMgmtTaskSuspend.
I have a Lookup table that maps:
trap_name → varbindname → Output_attribute_value.
After Lookup, I want to create a new field dynamically:
Field name = value of Output_attribute_value (e.g., id)
Field value = value from the field referenced by varbindname (e.g., trap_varbind_apSysMgmtTaskSuspend).
I tried using Eval with:
JavaScript
[Output_attribute_value] = get(__payload, varbindname)
Show more lines
…but got Unallowed assignment operator error.
Then I tried a Code function:
JavaScript
const targetField = event.Output_attribute_value;
const sourceField = event.varbindname;
if (targetField && sourceField && event[sourceField]) {
event[targetField] = event[sourceField];
}
Show more lines
But the new field (id) still doesn’t appear in the final JSON.
Questions:
Is Code function the right approach for dynamic field names?
How can I verify Lookup values before Code runs?
Any best practices for this pattern?
Example Input Event:
{
"_time": 1760492530.811,
"sourcetype": "snmp",
"snmpVersion": "v3",
"source": "snmp_v3",
"host": "10.142.161.160",
"version": 3,
"type": 7,
"msgId": 1840956767,
"msgMaxSize": 65507,
"msgFlags": "03",
"msgSecurityModel": 3,
"msgSecurityParams": {
"msgAuthoritativeEngineId": "80001f8880929dc55044e77d6800000000",
"msgAuthoritativeEngineBoots": 1,
"msgAuthoritativeEngineTime": 843108977,
"msgUserName": "testuser",
"msgAuthenticationParameters": "c796b6fbb861aab4e592750d0875eda5840f843522bd9c03c2f4d626fe5132d255145269a511b0ada0ea37dfcd7b51c6",
"msgPrivacyParameters": "48e6ce2dcb0352f6"
},
"isEncrypted": true,
"varbinds": [
{
"oid": "1.3.6.1.2.1.1.3.0",
"type": 67,
"value": 843108977
},
{
"oid": "1.3.6.1.6.3.1.1.4.1.0",
"type": 6,
"value": "1.3.6.1.4.1.9148.3.2.6.0.4"
},
{
"oid": "1.3.6.1.4.1.9148.3.2.6.0.4",
"type": 4,
"value": "SubNetwork=vodafonept_94701--vodafone-portugal_vbts-test-plant,MeContext=94701--vod.vbts-test.da627.pcx0,mm=1,eric-pc-mm-sctp-c8ff9cf78-f5ps9=1,25=1"
}
],
"community": "",
"reqid": 1196548379,
"error": 0,
"errorIndex": 0,
"trapOid": "1.3.6.1.4.1.9148.3.2.6.0.4",
"uptime": 843108977,
"mibName": "ACMEPACKET2-ENVMON-MIB | APSYSMGMT-MIB",
"trap_varbind_sysUptime": 843108977,
"trap_varbind_trapOid": "1.3.6.1.4.1.9148.3.2.6.0.4",
"trap_varbind_apSysMgmtTaskSuspend": "SubNetwork=vodafonept_94701--vodafone-portugal_vbts-test-plant,MeContext=94701--vod.vbts-test.da627.pcx0,mm=1,eric-pc-mm-sctp-c8ff9cf78-f5ps9=1,25=1",
"trap_name": "apSysMgmtTaskSuspendTrap",
"oid": "1.3.6.1.4.1.9148.3.2.6.0.4",
"alarmSlogan": "Indicates a task suspension event in the system",
"perceivedSeverity": "Critical",
"comment": "null",
"eventType": "2",
"state": "raised",
"alarmDetails": "alarm Description:Indicates a task suspension event in the system|EVENT TYPE:2",
"cribl_pipe": [
"snmp-trap-varbind-key_value",
"snmp-trap-varbind-key_value"
]
}
Lookup CSV Columns:
trap_name,varbindname,Output_attribute_value
Thanks in advance! :pray: