topic Re: Creating field value pair in Knowledge Management

Creating field value pair

splunkingsplun1 — Thu, 30 Jan 2014 21:05:51 GMT

According to the documentation here I need to have ids_type in my events as follows ids_type="network" or ids_type="application" or ids_type="host". How can I add a field value pair to my events automatically? Would I have to create this in transforms.conf?

[netdefender]
REGEX =  Netdefender
FORMAT = ids_type=network
WRITE_META = true

This is a portion of a sample event:

Jan 30 10:32:43 192.168.1.1 Netdefender: 30-01-2014 02:54:05 WARNING

I am not sure how this works its been a long day. Help please!

Re: Creating field value pair

asimagu — Mon, 03 Feb 2014 02:59:49 GMT

first of all you would need to specify something to extract in the regex, could we see some sample code in order to help you?

Re: Creating field value pair

somesoni2 — Mon, 03 Feb 2014 14:36:02 GMT

If you want to add an additional field for each sourcetype you can use calculated fields.

e.g.
props.conf (assuming 'netdefender' is your sourcetype name)

[netdefender]
pulldown_type = 1
EVAL-ids_type = "network"

This will add a field ids_type="network" for all the logs in sourcetype "netdefender"

Re: Creating field value pair

splunkingsplun1 — Thu, 06 Feb 2014 14:51:01 GMT

This worked just make sure to use quotes