topic Re: Dynamic source selection based on search in Dashboards & Visualizations

Dynamic source selection based on search

systematics78 — Tue, 19 Jan 2021 16:11:34 GMT

Hi.. I have in splunk logs comes from different sources.. and different events. For example, one type of events contains user information without server name:

Logged-in user {'kind': 'user', 'name': 'XXXXXX', 'admin': False, 'groups': [], 'server': '/jhub-test/user/XXXXXX/', 'pending': None, 'created': '2020-12-27T03:29:41.850432Z', 'last_activity': '2021-01-16T05:18:16.822564Z', 'servers': None}

and other have server ip on that..

So I need to construct query were I can select the source based on server ip search and after search the specific action - for example user logon events.

so I want to write some query like this:

if source=* contain ip address

when source="the actual source name which contain ip address" |search "*Logged*"

Re: Dynamic source selection based on search

to4kawa — Tue, 19 Jan 2021 22:30:21 GMT

Why don't you search and filter them all?

index=yours source=normal OR source=X.X.X.X "Logged"
| where match(source,"\d+\.\d+\.\d+\.\d+")

Re: Dynamic source selection based on search

systematics78 — Wed, 20 Jan 2021 06:59:43 GMT

I have source from multiply environments - for example SandBox, Dev, QA etc.. with exact same configuration and need to segregate by environment - so need to filter source by searching ip address to identify the source relationship with environment and after use just that source with some events..

Re: Dynamic source selection based on search

to4kawa — Wed, 20 Jan 2021 10:31:22 GMT

Create a lookup and check it against the source.

Re: Dynamic source selection based on search

systematics78 — Wed, 20 Jan 2021 10:36:49 GMT

Can I have more explanation what you exactly mean?

Re: Dynamic source selection based on search

to4kawa — Wed, 20 Jan 2021 10:40:52 GMT

https://docs.splunk.com/Documentation/Splunk/8.1.1/SearchReference/Lookup

A field with a description and a field with an IP address would be fine, I guess.

Re: Dynamic source selection based on search

systematics78 — Wed, 20 Jan 2021 10:45:50 GMT

I just want to construct a table for example:

Environment User Activity Username

DEV Logged IN systematics78

And I have sources from this environment but exactly with the same configuration

For example from Dev Environment I have log file with several rows like this

I log:187 10.161.2.165 some info

I log:587 Logged-In systematics78

For sandbox environment

I log:187 10.161.1.175 some info

I log:587 Logged-In systematics78

The logs name generated randomly on daily basis.. So I have just one info - ip address - based on that I can decide that User activity is related with for example DEV or Sandbox environment

So the main guest ion How I can create such report

Re: Dynamic source selection based on search

to4kawa — Wed, 20 Jan 2021 11:00:02 GMT

Re: Dynamic source selection based on search

systematics78 — Wed, 20 Jan 2021 11:00:59 GMT

Actually the fields not the same.. for example

log: [I 2021-01-20 10:50:14.071 JupyterHub log:174] 302 GET / -> /jhub-test/hub/ (@10.161.10.174) 1.30ms

log: [I 2021-01-19 08:05:10.633 JupyterHub login:43] User logged out: systematics

This is from the same source - So based on first row I can decide that user logged off from app in QA environment..

Re: Dynamic source selection based on search

to4kawa — Wed, 20 Jan 2021 11:29:48 GMT

log: [I 2021-01-20 10:50:14.071 JupyterHub log:174] 302 GET / -> /jhub-test/hub/ (@10.161.10.174) 1.30ms

log: [I 2021-01-19 08:05:10.633 JupyterHub login:43] User logged out: systematics

It has good features. Pay attention here.

Also, I think it says ip in the source, so you can extract it from there.

Re: Dynamic source selection based on search

systematics78 — Wed, 20 Jan 2021 12:15:00 GMT

Yes.. I know it.. I'm not so good on Splunk side.. that why I'm asking.. As I told i have more that 100+ such files as a source - some of them from different environment.. And I need just create dashboard and visualize users activities regarding with the environment.. I can construct this tables on segregated source.

Re: Dynamic source selection based on search

to4kawa — Wed, 20 Jan 2021 14:42:50 GMT

Splunk can create new fields with regular expressions, and there's nothing wrong with that.
Use rex as in my example.