Dashboards & Visualizations

Custom Log in Splunk

Rhuen
New Member

Hy,

i write a batch script that pings IP-Adresses.
The Results are in a .log file looks like:
Switch1 Online
Switch2 Online

When i add the .log as syslog in Splunk i see this entry:
1 » 12/4/12
2:07:44.000 PM

Switch2 Online

host=Splunkserver   Options|  
sourcetype=syslog   Options|  
source=C:\test.log   Options

2 » 12/4/12
2:07:44.000 PM

Switch1 Online

host=Splunkserver   Options|  
sourcetype=syslog   Options|  
source=C:\test.log  Options

How can i change the Entry for "host"? The i see host=Switch1 or Switch2, how must look my log file? And How can i add the Option "Status=Online", "Status=Offline" that i can create a search command like this:
source="C:\test.log" host="*" | stats count count(eval(Type="Online")) as On count(eval(Type="Offline")) as Off by host

When i try this, i see only a count at "counter" nothing at Off and On.

Any idea or tips for me?
thx

Tags (1)
0 Karma

kristian_kolb
Ultra Champion

You will have to make a dive into the world of index-time transforms.

Firstly, you have set the sourcetype to 'syslog', which it clearly isn't. This has implications, because Splunk will try to extract host information from each event. This will fail, since the events are not properly syslog-formatted. Change the sourcetype to 'my_ping_log' or something unique. Also, if possible, let the script add a date/timestamp to each event as well.

You should look at the following docs for rewriting the host value prior to indexing the events.

http://docs.splunk.com/Documentation/Splunk/5.0.1/Data/Overridedefaulthostassignments

I guess that your files should look something like;

props.conf

[my_ping_log]
TRANSFORMS-set_host = ping_script_host

transforms.conf

[ping_script_host]
REGEX = ^(\S+)\s+.*
DEST_KEY = MetaData:Host
FORMAT = host::$1

Please note that the REGEX works for the current event format, i.e. without a timestamp.

Hope this helps,

Kristian

Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...