How to tag all events from clients to defined "groups"

[romainbouajila]

Hello

I would like to add a tag to our Splunk clients by location.

I found how to create eventtypes on the server side but I am searching to tag all events directly on the client (in server.conf or inputs.conf maybe ?)

Is it doable ? If yes, what setting should I edit ?

[isoutamo]

Hi
The file is tags.conf and it’s editable on SH-layer.
r. Ismo

[romainbouajila]

Hello,

This solution implies to maintain a list of all our hosts on the Search Head if we want them all to be in a defined "group".

Isn't it possible to tag all logs from the client side ? (maybe tag is not the appropriate setting)

[gcusello]

Hi @romainbouajila,

the way to tag events is very easy, this is the process for one group, that you can repeat for more groups:

• you have to create a search that identify a group of hosts (e.g. al the hosts that names start with IT are italian server),
• than save this search as an eventype (e.g. italian_host),
• associate to this eventtype one or more tags (e.g.: IT),
• you can eventually create more divided eventtypes (e.g. italian hosts of HR dept.) associating to this eventtype more tags (e.g. IT, HR).

In this way you can create a search calling tags (e.g. you can call all the italian hosts using a simple search tag=IT).

I used this approach for an app that classifies all the login, logout and logfail events:

• I created for each technology I had three eventtypes,
• associating to each one a tag for the technology (e.g. WIN)
• and a tag for the action (e.g. LOGIN),
• in this way I was able to call the login events of all my technologies using a single tag (tag=LOGIN).

Ciao.

Giuseppe

[romainbouajila]

Thank you for your answer.

My issue is that we change many times naming convention for our servers, so I can't use the hostnames to identify location.

Since we have no pattern in hostnames or ip ranges for location, I am afraid of the maintainability of this solution (at every new server, edit the eventtype search to add it)

I would like to be able to deploy it from the client side, at the vm creation. What would be the appropriate solution for this case ?

[romainbouajila]

Should I stick to tags or should I check how to add metadata ?

[gcusello · Accepted solution]

Hi @romainbouajila,

the advantage to use eventtypes is that every updates has to be done in only one point, so if your hostnames chage you has to update only one eventtype.

Anyway, are you sure that your eventtyper change frequently? it's a strange thing!

If instead the problem is that you haven't a rule (e.g. italian servers tart with IT), you can list all the hosts of a group. e.g. eventtype italian_HT will be:

(host=server1 OR host=server3 OR host=server4)

as I said, if your list will change, you have to update only one eventtype.

Otherwise, you could use a lookup correlating each host to a tag, but in this way you have to manage the lookup, in my opinion the choice dependa on the user that has to manage the list:

• for a Splunk admin it's easier to manage an eventtype,
• for a Splunk user it's easier to manage a lookup using Lookup Editor.

Ciao.

Giuseppe