Getting Data In

How to separate IIS logs while parsing

riqbal47010
Path Finder

Hi Splunk Ninjas,

We have different web portals for different purposes. I categorize them as internal and external web portal.
Now under the cs_host field I have different values but both type of values are pointing as one web portal
for example.
cs_host=www.abc.com dvc/host= 1.2.3.4(External)
cs_host=abc.com dvc/host= 1.2.3.4(Internal)
cs_host=abc dvc/host= 1.2.3.4(Internal)
cs_host=www.xyz.com dvc/host= 1.2.3.4(External)
cs_host=xyz.com dvc/host= 1.2.3.4(Internal)
cs_host=xyz dvc/host= 1.2.3.4(External)

The idea comes in my mind to separate them based on either internal OR external
so if the cs_host=www.abc.com OR cs_host=www.xyz.com
then there should be another field name web_portal=external
and if cs_host=abc.com|abc OR cs_host=xyz|xyz.com
the cs_host values should become abc|xyz.

0 Karma
1 Solution

hgrow
Communicator

Hi riqbal47010,

beside calculated fields this would be achived best with a csv-file and an lookup.

You can define input fields (f.e. "cs_host") for different output fields (f.e. "web_portal") in your csv file and make that an (automatc) lookup. Wildcards and mutlple field combinations work aswell. For your needs something like should be a good start:

"cs_host","web_portal"
"xyz.com","external"
"xyz.dev","internal"
"*.dev","internal"

If you have the lookup working make it automatic so it gets applied autoamticly to every search on the source/sourcetype or hosts.

Greetings

View solution in original post

0 Karma

hgrow
Communicator

Hi riqbal47010,

beside calculated fields this would be achived best with a csv-file and an lookup.

You can define input fields (f.e. "cs_host") for different output fields (f.e. "web_portal") in your csv file and make that an (automatc) lookup. Wildcards and mutlple field combinations work aswell. For your needs something like should be a good start:

"cs_host","web_portal"
"xyz.com","external"
"xyz.dev","internal"
"*.dev","internal"

If you have the lookup working make it automatic so it gets applied autoamticly to every search on the source/sourcetype or hosts.

Greetings

0 Karma

riqbal47010
Path Finder

dear Hgrow,

This idea mekes sense to you. can you please help me to achieve this. furthermore can I expand this to f5.

0 Karma

riqbal47010
Path Finder

OR in simple can we achieve beow:

if (cs_host = www.abc.com OR cs_host=www.xyz.com OR cs_host="www.*"), External, internal)

0 Karma

RHASQaL
Path Finder

I suspect you need to use something from what Splunk call Knowledge Objects, there's a document all about them . I'm sure there were some sessions from past .conf's that covered this. I think in a previous life (when Splunk was my main focus - I only dabble now) I found this session useful.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...