Knowledge Management

How should the term "severity" be used when logging out errors from my app?

daniel333
Builder

All,

Can someone talk to me about how Splunk want's the term "severity" used?

Should I be logging out my errors using Splunk's CIM value severity from my app for the best compatibility with Splunk ES/PCI/ITS? Or, should I be using my own and severity is generated in those Apps on their own?

thanks,

0 Karma
1 Solution

esix_splunk
Splunk Employee
Splunk Employee

Keeping a standard format is the whole point of CIM, so using CIM normalized fields is the way to go, especially if you are using ES / PCI / ITSI. If you map your own severity based on the CIM model, then you dont have to do any Splunk-side mapping to CIM. However, not all server side apps follow the CIM-normalized severity levels. So it depends on your APP and your familiarity with Splunk as to where you want to do this normalization.

For me personally, I try to do this before data gets into Splunk, and then you can alias the field to severity (or leave it as is.)

Of course, the normalization is just a lookup that can be reused across source types... So you can make this and reuse this as needed without a lot of effort...

View solution in original post

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

Keeping a standard format is the whole point of CIM, so using CIM normalized fields is the way to go, especially if you are using ES / PCI / ITSI. If you map your own severity based on the CIM model, then you dont have to do any Splunk-side mapping to CIM. However, not all server side apps follow the CIM-normalized severity levels. So it depends on your APP and your familiarity with Splunk as to where you want to do this normalization.

For me personally, I try to do this before data gets into Splunk, and then you can alias the field to severity (or leave it as is.)

Of course, the normalization is just a lookup that can be reused across source types... So you can make this and reuse this as needed without a lot of effort...

0 Karma
Get Updates on the Splunk Community!

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...