- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- How to assign fields to event/logs which do not co...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to assign fields to event/logs which do not contain target string
I have two applications, these can exist in preprod or live environments. I want to have a field on logs from both applications called "environment", which is set to LIVE if it is in the live environment.
Using field extractions I am able to extract whether a URI is from a live or preprod server for Application A by extracting LIVE when it appears in the URI and putting it into a field. This is easy as LIVE URIs include the string LIVE.
regex to match start of URI... (?P(?i)(LIVE))
For Application B it is different, PREPROD URIs are marked PREPROD, and LIVE versions are unmarked. However, for consistency between applications, I'd like to put a live field on to the live URIs. As there is no longer a 'LIVE' string to extract from the live URIs (live URIs for this app are shown by a lack of PREPROD), I'm not sure how to do this with a regex field extraction. I need to basically detect logs which do not contain preprod, and create a new field on them, named environment, populated with the value 'live'.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Okay, it can be done. Extractions are not really designed to be "programmed", but you can usually make it happen.
There may be a more elegant way, but as long as you can get the rules to operate in this exact order, then here's some pseudocode on how you can do it, in four rules.
1) extract the appname
2) if appname matches app A, set environment to PREPROD
3) if appname matches app B, set environment to LIVE
4) if URI contains LIVE or PREPROD, set environment to that value
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks for the answer. Is this all done with field extractions? For example how would I do step 1, set environment in the same extraction which sets the app name?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How are you distinguishing between log records that come from one application and those that come from the other? Do they have different sourcetypes, or another major distinguishing characteristic at index time?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
There is another field for app_name extracted in a series of separate field extractions. It is extracted from the URI in an IIS log.
Announcing Scheduled Export GA for Dashboard Studio
Extending Observability Content to Splunk Cloud
More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!
