All Apps and Add-ons

Parsing fields from Azure Log Analytics KQL Grabber

edhealea
Path Finder

Has anyone successfully parsed fields from the data gathered with Azure Log Analytics KQL Grabber?
We are working on pulling Log Analytics logs from Azure using KQL Grabber which works great for doing this. We are finding because KQL sends everything to the sourcetype KQL, we can't consistently parse fields out for our different inputs we have defined within KQL.

Labels (1)
0 Karma

dmcintosh1972
Explorer

you could set up different inputs with a relevant source type on the input field of the form.  or if you are planning to use a single input with multiple tables coming in you can set up props and transforms in the app to modify the sourcetype value based on your logs. look for an identifying field with 100% log coverage, use that in a regex to identify your records and modify the sourcetype.

0 Karma

02sangeet
Engager

Could you please help us, giving some idea about the extraction you used to solve this issue. I am also facing the same issue here, though  we are able to fetch some data from MS Azure log analytics but data shows only header part.

0 Karma

edhealea
Path Finder

If you are only getting header information, check your query in Log Analytics first. If it works correctly there then it should work in KQL. We haven't had one not work yet.

Also, Some logs in Azure only have header info and no data.  Not sure why that is.

0 Karma

a_naoum
Path Finder

In the latest version, you have the possibility to define sourcetype per stanza. I guess this can help you. 

As workaround you can always go to inputs.conf and hardcode the sourcetype there. That's general approach regardless the addon that you are using.

0 Karma
Get Updates on the Splunk Community!

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

[Coming Soon] Splunk Observability Cloud - Enhanced navigation with a modern look and ...

We are excited to introduce our enhanced UI that brings together AppDynamics and Splunk Observability. This is ...