Add support for a mix of indexed fields and search-time fields

copycat/default/app.conf

@@ -1,6 +1,6 @@
 [id]
 name = copycat
-version = 0.2.0
+version = 0.3.0
 
 [ui]
 is_visible = 0
@@ -9,7 +9,7 @@ label = copycat
 [launcher]
 author = Lynx AI
 description = A lightweight, dependency-free Splunk app that generates realistic mock logs for testing AI agents, parsing rules, and data analysis workflows.
-version = 0.2.0
+version = 0.3.0
 
 [package]
 check_for_updates = 1

copycat/default/fields.conf

@@ -0,0 +1,29 @@
+[copycat_level]
+INDEXED = true
+
+[copycat_user]
+INDEXED = true
+
+[copycat_transport]
+INDEXED = true
+
+[copycat_action]
+INDEXED = true
+
+[copycat_query_type]
+INDEXED = true
+
+[copycat_process]
+INDEXED = true
+
+[copycat_method]
+INDEXED = true
+
+[copycat_status]
+INDEXED = true
+
+[copycat_error_type]
+INDEXED = true
+
+[copycat_resource]
+INDEXED = true

copycat/default/props.conf

@@ -1,35 +1,44 @@
 [copycat:app]
 TIME_FORMAT = %Y-%m-%d %T.%f
+TRANSFORMS-copycat_app_indexed = copycat_app_indexed
 EXTRACT-copycat_app_fields = \[(?<level>\w+)\]\s(?<path>(/[\w\.]+)+):\s(?<message>.*)
 
 [copycat:security]
 TIME_FORMAT = %Y-%m-%d %T.%f
+TRANSFORMS-copycat_security_indexed = copycat_security_indexed
 EXTRACT-copycat_security_fields = User\s(?<user>[\w\.]+)\slogin\sattempt\sfrom\s(?<ip>\d+\.\d+\.\d+\.\d+)
 
 [copycat:network]
 TIME_FORMAT = %Y-%m-%d %T.%f
+TRANSFORMS-copycat_network_indexed = copycat_network_indexed
 EXTRACT-copycat_network_fields = (?<transport>\w+)\s(?<src_ip>\d+\.\d+\.\d+\.\d+):(?<src_port>\d+)\s-\>\s(?<dest_ip>\d+\.\d+\.\d+\.\d+):(?<dest_port>\d+)\s(?<action>\w+)
 
 [copycat:docker]
 TIME_FORMAT = %Y-%m-%d %T.%f
+TRANSFORMS-copycat_docker_indexed = copycat_docker_indexed
 EXTRACT-copycat_docker_fields = Container\s(?<container_name>[\w\-]+)\s(?<action>\w+)
 
 [copycat:database]
 TIME_FORMAT = %Y-%m-%d %T.%f
+TRANSFORMS-copycat_database_indexed = copycat_database_indexed
 EXTRACT-copycat_database_fields = (?<query_type>\w+)\squery\sexecuted\son\stable\s(?<table_name>\w+)\sby\suser\s(?<user>[\w\.]+)\s-\s(?<duration>\d+)ms
 
 [copycat:system]
 TIME_FORMAT = %Y-%m-%d %T.%f
+TRANSFORMS-copycat_system_indexed = copycat_system_indexed
 EXTRACT-copycat_system_fields = (?<process>\w+)\[(?<pid>\d+)\]:\s(?<message>.*)
 
 [copycat:api]
 TIME_FORMAT = %Y-%m-%d %T.%f
+TRANSFORMS-copycat_api_indexed = copycat_api_indexed
 EXTRACT-copycat_api_fields = (?<method>\w+)\s(?<path>(/\w+)+)\sfrom\s(?<ip>\d+\.\d+\.\d+\.\d+)\s-\sResponse:\s(?<http_status>\d+)\s-\s(?<duration>\d+)ms
 
 [copycat:error]
 TIME_FORMAT = %Y-%m-%d %T.%f
+TRANSFORMS-copycat_error_indexed = copycat_error_indexed
 EXTRACT-copycat_error_fields = (?<type>\w+)\sin\s(?<path>(/[\w\.]+)+):(?<line>\d+)\s-\s(?<message>.*)
 
 [copycat:metrics]
 TIME_FORMAT = %Y-%m-%d %T.%f
+TRANSFORMS-copycat_metrics_indexed = copycat_metrics_indexed
 EXTRACT-copycat_metrics_fields = (?<resource>\w+)\susage:\s(?<usage_percentage>\d+)\%\s-\sHost:\s(?<target_host>[\w\.-]+)

copycat/default/transforms.conf

@@ -0,0 +1,44 @@
+[copycat_app_indexed]
+REGEX = ^\S+\s\S+\s\[(\w+)\]
+FORMAT = copycat_level::$1
+WRITE_META = true
+
+[copycat_security_indexed]
+REGEX = ^\S+\s\S+\sUser\s([\w\.]+)\s
+FORMAT = copycat_user::$1
+WRITE_META = true
+
+[copycat_network_indexed]
+REGEX = ^\S+\s\S+\s(\w+)\s\S+\s->\s\S+\s(\w+)
+FORMAT = copycat_transport::$1 copycat_action::$2
+WRITE_META = true
+
+[copycat_docker_indexed]
+REGEX = ^\S+\s\S+\sContainer\s\S+\s(\w+)
+FORMAT = copycat_action::$1
+WRITE_META = true
+
+[copycat_database_indexed]
+REGEX = ^\S+\s\S+\s(\w+)\squery\sexecuted
+FORMAT = copycat_query_type::$1
+WRITE_META = true
+
+[copycat_system_indexed]
+REGEX = ^\S+\s\S+\s(\w+)\[\d+\]:
+FORMAT = copycat_process::$1
+WRITE_META = true
+
+[copycat_api_indexed]
+REGEX = ^\S+\s\S+\s(\w+)\s\S+\sfrom\s\S+\s-\sResponse:\s(\d+)
+FORMAT = copycat_method::$1 copycat_status::$2
+WRITE_META = true
+
+[copycat_error_indexed]
+REGEX = ^\S+\s\S+\s(\w+)\sin\s
+FORMAT = copycat_error_type::$1
+WRITE_META = true
+
+[copycat_metrics_indexed]
+REGEX = ^\S+\s\S+\s(\w+)\susage:
+FORMAT = copycat_resource::$1
+WRITE_META = true

copycat/metadata/default.meta

@@ -3,3 +3,9 @@ access = read : [ * ], write : [ admin, sc_admin ]
 
 [props]
 export = system
+
+[transforms]
+export = system
+
+[fields]
+export = system

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "copycat"
-version = "0.2.0"
+version = "0.3.0"
 description = "A lightweight, dependency-free Splunk app that generates realistic fake logs for testing AI agents, parsing rules, and data analysis workflows."
 readme = "README.md"
 requires-python = ">=3.9"