topic Re: How to create a custom field with values based on the monitors in inputs.conf in Splunk Search

How to create a custom field with values based on the monitors in inputs.conf

jackiewkc — Fri, 21 Aug 2015 16:39:58 GMT

Hi,

In my inputs.conf I have a number of monitors. I would like to create a custom field called logtypevalue with values based of the monitors. For example, if the monitor is:

[monitor://D:\logs\logfiles\tomcat*.log]

I want the value of logtypevalue set to abcde.

If the monitor is:

[monitor://D:\logs\logfiles\apache*.log]

I want the value of logtypevalue set to testing.

Basically the values of logtypevalue can't be extracted from the monitor so I am not sure how I can do this.

Any help will be greatly appreciated.

Thanks.

Jackie

Re: How to create a custom field with values based on the monitors in inputs.conf

richgalloway — Fri, 21 Aug 2015 17:21:30 GMT

I don't know you can do that in inputs.conf, but it's possible in props.conf. In the appropriate stanza for each input's sourcetype add

EVAL-logtypevalue = "abcde"

EVAL-logtypevalue = "testing"

Re: How to create a custom field with values based on the monitors in inputs.conf

woodcock — Fri, 21 Aug 2015 23:19:51 GMT

You can hard-code each monitor inside inputs.conf with a unique sourcetype such as STunique1, STunique2, etc.
Then inside props.conf you do like @richgalloway said and use EVAL-logtypevalue="testing" or whatever, for each unique sourcetype but you also rename the sourcetype here with rename = "STcommon" so that in the end, each one goes back to sharing the same sourcetype but with unique values for logtypevalue!

Re: How to create a custom field with values based on the monitors in inputs.conf

jackiewkc — Mon, 24 Aug 2015 12:36:05 GMT

Thanks a lot. I managed to do it based on your suggestion.

In props.conf, I have this setting:

[source::D:\\abc\\testing*.log]
EVAL-log_type = "testing-logs"

[source::D:\\def\\reporting*.log]
EVAL-log_type = "reporting-logs"

Now my question is that is it possible to specify the index in the above settings as well?

It may happen that logs with the same paths coming from different servers for different indexes will match the paths above. I only want those that match the paths above and for a particular index to have log_type configured.

Is this possible?

Thanks.

Re: How to create a custom field with values based on the monitors in inputs.conf

jackiewkc — Mon, 24 Aug 2015 12:40:11 GMT

Thanks a lot. I managed to do it based on your suggestion.

In props.conf, I have this setting:

[source::D:\abc\testing*.log]
EVAL-log_type = "testing-logs"

[source::D:\def\reporting*.log]
EVAL-log_type = "reporting-logs"

Now my question is that is it possible to specify the index in the above settings as well?

Is this possible?

Thanks.

Re: How to create a custom field with values based on the monitors in inputs.conf

richgalloway — Mon, 24 Aug 2015 12:43:06 GMT

You can include index=foo in your inputs.conf file, but not props.conf.

Re: How to create a custom field with values based on the monitors in inputs.conf

woodcock — Mon, 24 Aug 2015 17:12:52 GMT

See my alternative answer. It will allow you to take into effect the index value by doing this based on sourcetype rather than by source (eliminating your problem entirely).

Re: How to create a custom field with values based on the monitors in inputs.conf

jackiewkc — Tue, 25 Aug 2015 08:17:43 GMT

Thanks for the reply, but the problem we have is that we use sourcetype for something else (linebreak). Therefore in our inputs.conf, there are multiple monitors with the same sourcetype which can't be changed. This means the only thing we can use to distinguish between different sources (i.e. monitors) is the source itself.

Now I have updated props.conf with the settings in my reply above, and it works fine. There should not be another monitor with the exact same path but for a different index cos that would not be right, but I am just thinking out loud here whether it is possible to include the index in the configs above. Something like if the source is D:\def\reporting*.log and it is for the index "abc" then do the EVAL-log_type part.

Thanks.

Re: How to create a custom field with values based on the monitors in inputs.conf

woodcock — Tue, 25 Aug 2015 13:56:07 GMT

Not possible.

Re: How to create a custom field with values based on the monitors in inputs.conf

jackiewkc — Tue, 25 Aug 2015 14:57:14 GMT

ok, thanks for getting back to me.