Getting Data In

How to accommodate changes to event names

MatMeredith
Path Finder

Our Splunk server is processing logs with a “name” attribute in them. One of many possible values of that name is “Call Ended”. However, recently the product generating these logs has changed so that it now logs “Call End” instead in that case.

It is likely that there will be other such changes in future.

What's the best way to handle this in Splunk? I want to be able to write queries that say e.g. name="Call Ended" and not have to update all those queries if the name subsequently changes. I thought about using a lookup table, but the problem then is that I believe the table would need to have rows for every possible value of name which would be a significant maintenance overhead.

Tags (1)
0 Karma

kristian_kolb
Ultra Champion

One way of doing it would be by using eventtypes. You can create an eventtype which would contain the following;

sourcetype=your_sourcetype name="Call End" OR name="Call Ended" OR name="Call Finished" OR name="Disconnected" etc etc.

Assuming you've named this eventtype "HangUp", you can then build your searches like;

eventtype=HangUp OR blah blah | blah blah

If you need to add more variants of the call ending notification, you can do that in the eventtype. All searches using the eventtype will be using the new definition automatically.

http://docs.splunk.com/Documentation/Splunk/5.0.2/Knowledge/ClassifyAndGroupSimilarEvents

Hope this helps,

Kristian

0 Karma

kristian_kolb
Ultra Champion

To build an eventtype like that, you do not need to map all possible values of name, just the ones that are meaningful for you. It does not matter that name sometimes take values like SherlockHolmes, Soylent_Green or Skippy. These won't match the eventtype definition, and will thus not be returned as search results.

Naturally you can call the eventtype whatever you like. For the sake of simplicity for users, you can create an eventtype for the call start event too, even if it's just one option.

Of course, you can always look at tagging, as martin_mueller suggests.

/K

0 Karma

MatMeredith
Path Finder

Thanks Kristian. The issue is that name can also take lots of values that I don't need to (or want to have to) map. I'd like users to be able to write searches without having to know whether the event name I'm searching for corresponds to multiple values or not. So, I'd like to be able to do e.g.
-- name = "Call started" (where the event has only ever been called "Call started" and no mapping is required)
-- name = "Call ended" (where under the covers "Call Ended" is being mapped to ("Call End" or "Call Ended" or ...)
Can I do that?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust
0 Karma
Get Updates on the Splunk Community!

Splunk Classroom Chronicles: Training Tales and Testimonials

Welcome to the "Splunk Classroom Chronicles" series, created to help curious, career-minded learners get ...

Access Tokens Page - New & Improved

Splunk Observability Cloud recently launched an improved design for the access tokens page for better ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...