Replace/enhance informations inside searched data with (additional) text-file informations

[mchrotte]

Hello, i hope you understand what i want to do... (normally: german ;-))
I want to add additional data into my indexed syslog-data.
For example, i`ve got this indexed data:

Nov 21 14:25:02 m31w2-sw12.itmc.tu-dortmund.de 14049: Nov 21 14:25:05: %DHCP_SNOOPING-5-DHCP_SNOOPING_MATCH_MAC_FAIL: DHCP_SNOOPING drop message because the chaddr doesn't match source mac, message type: DHCPREQUEST, chaddr: 8c7a.9110.af98, MAC sa: 544e.7522.ea34

...and i want to know more information in this string, for example, my (additional) data out of an text file:

moddate; host; port; description; vlaninfo
Nov 21 02:13 ;m31w2-sw12.itmc.tu-dortmund.de; FastEthernet0/6; Room 3 Port 6; switchport access vlan 160

Is ist possible to "merge" this data?
The "moddate" is the last information about the actuality of the given information.
I thought it could be possible to combine the "host" and the "port" informations to add the description and the vlaninfo into the (searched) syslog-entry...

Is it possible or could i get this in anouther way?
Many thanks.
BR
Christian

[lguinn2]

It is certainly possible to merge this data. And there is more than one way to accomplish your goal. To make this discussion easier, assume that the sourcetype/name for the first event is "syslog" and that the data from the table is called "location".

I think that a lookup provides a great solution. Here are the docs on creating a lookup via the GUI.

Before you load the location data into a lookup table, you may need to edit the format a bit. In particular, you need for the format of the port field in the table to match the format of the port field in the syslog data. You also need to put the table in CSV format.
Then, upload the location information into a csv lookup table in Splunk.
Next, create a lookup; for this example, let's call it location_lookup. As part of defining the lookup, you should also "Configure time-based lookup." Use the time-based options to make sure that the syslog date is after the moddate of the corresponding location entry. Once the data is uploaded and the lookup is defined, you can use it like this:

sourcetype=syslog host=* port=*
| lookup location_lookup host port OUTPUT description vlaninfo

This is very easy to use and understand - although you did have to do some additional background work. to set up the lookup.
You will also need to plan for ongoing maintenance of the lookup table. It can easily be replaced with a simple repeat of the upload. This can also be done via a routine OS-level script.