Getting Data In

How to accommodate changes to event names

MatMeredith
Path Finder

Our Splunk server is processing logs with a “name” attribute in them. One of many possible values of that name is “Call Ended”. However, recently the product generating these logs has changed so that it now logs “Call End” instead in that case.

It is likely that there will be other such changes in future.

What's the best way to handle this in Splunk? I want to be able to write queries that say e.g. name="Call Ended" and not have to update all those queries if the name subsequently changes. I thought about using a lookup table, but the problem then is that I believe the table would need to have rows for every possible value of name which would be a significant maintenance overhead.

Tags (1)
0 Karma

kristian_kolb
Ultra Champion

One way of doing it would be by using eventtypes. You can create an eventtype which would contain the following;

sourcetype=your_sourcetype name="Call End" OR name="Call Ended" OR name="Call Finished" OR name="Disconnected" etc etc.

Assuming you've named this eventtype "HangUp", you can then build your searches like;

eventtype=HangUp OR blah blah | blah blah

If you need to add more variants of the call ending notification, you can do that in the eventtype. All searches using the eventtype will be using the new definition automatically.

http://docs.splunk.com/Documentation/Splunk/5.0.2/Knowledge/ClassifyAndGroupSimilarEvents

Hope this helps,

Kristian

0 Karma

kristian_kolb
Ultra Champion

To build an eventtype like that, you do not need to map all possible values of name, just the ones that are meaningful for you. It does not matter that name sometimes take values like SherlockHolmes, Soylent_Green or Skippy. These won't match the eventtype definition, and will thus not be returned as search results.

Naturally you can call the eventtype whatever you like. For the sake of simplicity for users, you can create an eventtype for the call start event too, even if it's just one option.

Of course, you can always look at tagging, as martin_mueller suggests.

/K

0 Karma

MatMeredith
Path Finder

Thanks Kristian. The issue is that name can also take lots of values that I don't need to (or want to have to) map. I'd like users to be able to write searches without having to know whether the event name I'm searching for corresponds to multiple values or not. So, I'd like to be able to do e.g.
-- name = "Call started" (where the event has only ever been called "Call started" and no mapping is required)
-- name = "Call ended" (where under the covers "Call Ended" is being mapped to ("Call End" or "Call Ended" or ...)
Can I do that?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust
0 Karma
Get Updates on the Splunk Community!

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...

Splunk With AppDynamics - Meet the New IT (And Engineering) Couple

Wednesday, November 20, 2024  |  10AM PT / 1PM ET Register Now Join us in this session to learn all about ...