Getting Data In

How to separate IIS logs while parsing

riqbal47010
Path Finder

Hi Splunk Ninjas,

We have different web portals for different purposes. I categorize them as internal and external web portal.
Now under the cs_host field I have different values but both type of values are pointing as one web portal
for example.
cs_host=www.abc.com dvc/host= 1.2.3.4(External)
cs_host=abc.com dvc/host= 1.2.3.4(Internal)
cs_host=abc dvc/host= 1.2.3.4(Internal)
cs_host=www.xyz.com dvc/host= 1.2.3.4(External)
cs_host=xyz.com dvc/host= 1.2.3.4(Internal)
cs_host=xyz dvc/host= 1.2.3.4(External)

The idea comes in my mind to separate them based on either internal OR external
so if the cs_host=www.abc.com OR cs_host=www.xyz.com
then there should be another field name web_portal=external
and if cs_host=abc.com|abc OR cs_host=xyz|xyz.com
the cs_host values should become abc|xyz.

0 Karma
1 Solution

hgrow
Communicator

Hi riqbal47010,

beside calculated fields this would be achived best with a csv-file and an lookup.

You can define input fields (f.e. "cs_host") for different output fields (f.e. "web_portal") in your csv file and make that an (automatc) lookup. Wildcards and mutlple field combinations work aswell. For your needs something like should be a good start:

"cs_host","web_portal"
"xyz.com","external"
"xyz.dev","internal"
"*.dev","internal"

If you have the lookup working make it automatic so it gets applied autoamticly to every search on the source/sourcetype or hosts.

Greetings

View solution in original post

0 Karma

hgrow
Communicator

Hi riqbal47010,

beside calculated fields this would be achived best with a csv-file and an lookup.

You can define input fields (f.e. "cs_host") for different output fields (f.e. "web_portal") in your csv file and make that an (automatc) lookup. Wildcards and mutlple field combinations work aswell. For your needs something like should be a good start:

"cs_host","web_portal"
"xyz.com","external"
"xyz.dev","internal"
"*.dev","internal"

If you have the lookup working make it automatic so it gets applied autoamticly to every search on the source/sourcetype or hosts.

Greetings

0 Karma

riqbal47010
Path Finder

dear Hgrow,

This idea mekes sense to you. can you please help me to achieve this. furthermore can I expand this to f5.

0 Karma

riqbal47010
Path Finder

OR in simple can we achieve beow:

if (cs_host = www.abc.com OR cs_host=www.xyz.com OR cs_host="www.*"), External, internal)

0 Karma

RHASQaL
Path Finder

I suspect you need to use something from what Splunk call Knowledge Objects, there's a document all about them . I'm sure there were some sessions from past .conf's that covered this. I think in a previous life (when Splunk was my main focus - I only dabble now) I found this session useful.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...