topic How to assign fields to event/logs which do not contain target string in Splunk Search

How to assign fields to event/logs which do not contain target string

JpAnderson_2 — Fri, 07 Apr 2017 15:16:39 GMT

I have two applications, these can exist in preprod or live environments. I want to have a field on logs from both applications called "environment", which is set to LIVE if it is in the live environment.

Using field extractions I am able to extract whether a URI is from a live or preprod server for Application A by extracting LIVE when it appears in the URI and putting it into a field. This is easy as LIVE URIs include the string LIVE.

regex to match start of URI... (?P(?i)(LIVE))

For Application B it is different, PREPROD URIs are marked PREPROD, and LIVE versions are unmarked. However, for consistency between applications, I'd like to put a live field on to the live URIs. As there is no longer a 'LIVE' string to extract from the live URIs (live URIs for this app are shown by a lack of PREPROD), I'm not sure how to do this with a regex field extraction. I need to basically detect logs which do not contain preprod, and create a new field on them, named environment, populated with the value 'live'.

Re: How to assign fields to event/logs which do not contain target string

DalJeanis — Fri, 07 Apr 2017 15:42:11 GMT

How are you distinguishing between log records that come from one application and those that come from the other? Do they have different sourcetypes, or another major distinguishing characteristic at index time?

Re: How to assign fields to event/logs which do not contain target string

JpAnderson_2 — Fri, 07 Apr 2017 15:45:12 GMT

There is another field for app_name extracted in a series of separate field extractions. It is extracted from the URI in an IIS log.

Re: How to assign fields to event/logs which do not contain target string

DalJeanis — Fri, 07 Apr 2017 16:11:04 GMT

Okay, it can be done. Extractions are not really designed to be "programmed", but you can usually make it happen.

There may be a more elegant way, but as long as you can get the rules to operate in this exact order, then here's some pseudocode on how you can do it, in four rules.

1) extract the appname
2) if appname matches app A, set environment to PREPROD
3) if appname matches app B, set environment to LIVE
4) if URI contains LIVE or PREPROD, set environment to that value

Re: How to assign fields to event/logs which do not contain target string

JpAnderson_2 — Tue, 11 Apr 2017 10:24:25 GMT

Thanks for the answer. Is this all done with field extractions? For example how would I do step 1, set environment in the same extraction which sets the app name?