How to accommodate changes to event names

[MatMeredith]

Our Splunk server is processing logs with a “name” attribute in them. One of many possible values of that name is “Call Ended”. However, recently the product generating these logs has changed so that it now logs “Call End” instead in that case.

It is likely that there will be other such changes in future.

What's the best way to handle this in Splunk? I want to be able to write queries that say e.g. name="Call Ended" and not have to update all those queries if the name subsequently changes. I thought about using a lookup table, but the problem then is that I believe the table would need to have rows for every possible value of name which would be a significant maintenance overhead.

[kristian_kolb]

One way of doing it would be by using eventtypes. You can create an eventtype which would contain the following;

sourcetype=your_sourcetype name="Call End" OR name="Call Ended" OR name="Call Finished" OR name="Disconnected" etc etc.

Assuming you've named this eventtype "HangUp", you can then build your searches like;

eventtype=HangUp OR blah blah | blah blah

If you need to add more variants of the call ending notification, you can do that in the eventtype. All searches using the eventtype will be using the new definition automatically.

http://docs.splunk.com/Documentation/Splunk/5.0.2/Knowledge/ClassifyAndGroupSimilarEvents

Hope this helps,

Kristian

[kristian_kolb]

To build an eventtype like that, you do not need to map all possible values of name, just the ones that are meaningful for you. It does not matter that name sometimes take values like SherlockHolmes, Soylent_Green or Skippy. These won't match the eventtype definition, and will thus not be returned as search results.

Naturally you can call the eventtype whatever you like. For the sake of simplicity for users, you can create an eventtype for the call start event too, even if it's just one option.

Of course, you can always look at tagging, as martin_mueller suggests.

/K

[MatMeredith]

Thanks Kristian. The issue is that name can also take lots of values that I don't need to (or want to have to) map. I'd like users to be able to write searches without having to know whether the event name I'm searching for corresponds to multiple values or not. So, I'd like to be able to do e.g.
-- name = "Call started" (where the event has only ever been called "Call started" and no mapping is required)
-- name = "Call ended" (where under the covers "Call Ended" is being mapped to ("Call End" or "Call Ended" or ...)
Can I do that?

[martin_mueller]

Take a look at tagging: http://docs.splunk.com/Documentation/Splunk/5.0.2/Knowledge/Abouttagsandaliases