How to separate IIS logs while parsing

[riqbal47010]

Hi Splunk Ninjas,

We have different web portals for different purposes. I categorize them as internal and external web portal.
Now under the cs_host field I have different values but both type of values are pointing as one web portal
for example.
cs_host=www.abc.com dvc/host= 1.2.3.4(External)
cs_host=abc.com dvc/host= 1.2.3.4(Internal)
cs_host=abc dvc/host= 1.2.3.4(Internal)
cs_host=www.xyz.com dvc/host= 1.2.3.4(External)
cs_host=xyz.com dvc/host= 1.2.3.4(Internal)
cs_host=xyz dvc/host= 1.2.3.4(External)

The idea comes in my mind to separate them based on either internal OR external
so if the cs_host=www.abc.com OR cs_host=www.xyz.com
then there should be another field name web_portal=external
and if cs_host=abc.com|abc OR cs_host=xyz|xyz.com
the cs_host values should become abc|xyz.

[hgrow · Accepted solution]

Hi riqbal47010,

beside calculated fields this would be achived best with a csv-file and an lookup.

You can define input fields (f.e. "cs_host") for different output fields (f.e. "web_portal") in your csv file and make that an (automatc) lookup. Wildcards and mutlple field combinations work aswell. For your needs something like should be a good start:

"cs_host","web_portal"
"xyz.com","external"
"xyz.dev","internal"
"*.dev","internal"

If you have the lookup working make it automatic so it gets applied autoamticly to every search on the source/sourcetype or hosts.

Greetings

[riqbal47010]

dear Hgrow,

This idea mekes sense to you. can you please help me to achieve this. furthermore can I expand this to f5.

[riqbal47010]

OR in simple can we achieve beow:

if (cs_host = www.abc.com OR cs_host=www.xyz.com OR cs_host="www.*"), External, internal)

[RHASQaL]

I suspect you need to use something from what Splunk call Knowledge Objects, there's a document all about them . I'm sure there were some sessions from past .conf's that covered this. I think in a previous life (when Splunk was my main focus - I only dabble now) I found this session useful.