Permanent tag

[timrcase]

We will regularly move machines between environments (DEV/QA/PRD). We are currently using tags to assign a machine to an environment, but when we move the machine all the history moves with it. Is there a better way to do this instead of tags, or is there a way to persist a tag? I'm guessing I cannot persist a tag since my understanding is that they are meant to be transient...

[Ayn · Accepted solution]

You could perhaps solve this using temporal (time-based) lookups, where you specify a time period and an environment for each server, and a new time period when the server's environment changes.

http://docs.splunk.com/Documentation/Splunk/5.0.2/Knowledge/Addfieldsfromexternaldatasources#Set_up_...

[lguinn2]

That would be my solution as well. The lookup CSV could contain

host,hostEnv,startDate
server01,PRD,21-Mar-2013 00:00
server01,QA,15-Mar-2013 02:00
server02,PRD,1-Jul-2010 00:00

etc.

[timrcase]

An example: server01 is part of our DEV application environment and tagged as such. Next month we decide to move server01 to our PRD application environment and update the tags in Splunk accordingly. The problem is, all the data that Splunk has indexed for server01 is now attributed to PRD.

In traditional DW/BI this is handled via slowly changing dimensions, but I'm not aware of anything like that in Splunk.

[lguinn2]

I am not sure what you mean by "when we move the machine all the history moves with it." Is that what you do now, or what you are trying to figure out how to do?

Do you have multiple Splunk environments for DEV/QA/PROD? Do you have separate indexes for DEV/QA/PROD?

Splunk tags are persistent within a Splunk environment, but they are not indexed. I guess the bottom line question is: what do you want to move between environments: log data, config data (like tags) or something else?