topic Re: Add 'static' field to all events from a source (syslogs) in Splunk Search

Add 'static' field to all events from a source (syslogs)

tskimball — Wed, 20 Apr 2011 11:48:03 GMT

I have a dedicated index for syslogs that I would like to add a 'static field' to:

MonFunc=sysmsgs ### Add to all events in this index

I'm trying to merge this data with related info in another logging index (which has a field extract for various function errors, generating the MonFunc). But, doing an aggregate table-based summary (from all indexes), grouped by MonFunc, has all the syslogs showing up as NULL.

I know of one possible workaround (our monitor system has its own filter and log, adding its own msg before the actual syslog), but would prefer a 'simpler' solution than generating a custom syslog extractor. It would also end up bypassing other data that may be useful long-term, which I'm trying to avoid.

Re: Add 'static' field to all events from a source (syslogs)

netwrkr — Wed, 20 Apr 2011 12:45:29 GMT

Are you simply trying to insert a placeholder field which will be later defined by other query?

Re: Add 'static' field to all events from a source (syslogs)

hazekamp — Wed, 20 Apr 2011 17:54:07 GMT

To add a static kv pair to all events in an index I would recommend using a lookup table to map index->MonFunc. The trick is to use a global (no stanza) property unless you can scope to a particular source/sourcetype/host. I didn't find the name of your index, so be sure to change "index_name" to reflect the name of the index you want to assign the kv pair to:

## MonFunc.csv
index,MonFunc
index_name,sysmsgs

## transforms.conf
[MonFunc_lookup]
filename = MonFunc.csv

## props.conf
LOOKUP-MonFunc_for_index_name = MonFunc_lookup index OUTPUT MonFunc

Re: Add 'static' field to all events from a source (syslogs)

tskimball — Thu, 21 Apr 2011 04:35:26 GMT

This is for adding an (already defined) field that shows what function the message came from.

In the case of our monitoring app, all syslogs come from a function named 'sysmsgs.' Setting that field for all incoming syslogs will help prevent confusion for our end users.

Re: Add 'static' field to all events from a source (syslogs)

tskimball — Thu, 21 Apr 2011 04:42:44 GMT

Excellent, that worked. Thanks.

Re: Add 'static' field to all events from a source (syslogs)

davecroto — Sat, 22 Sep 2012 03:06:21 GMT

Devise a common sourcetype

example lookup csv called myexample.csv

sourcetype,SLA,NAME,VALUE
foobar,99,TechnicalError,456

transforms.conf:

[myexamplelookup]
filename=myexample.csv

props.conf
[foobar]
LOOKUP-myexamplelookup = myexamplelookup sourcetype VALUE OUTPUT SLA NAME VALUE