Splunk Enterprise

Reuse-able Pattern matching blocks for eval?

splunkernator
Path Finder

Code is easier to explain: I wanted a bunch of new categories and i found eval especially useful - here is an obfuscated example

| index=my_index CONNECTED source="/var/log/vmware/my_log.log" 
| eval vdi_pool=case(
    match(name,"1A-VDI\d{3}"), "pool1",
    match(name,"1B-VDI\d{3}"), "pool2",
    match(name,"2A-VDI\d{3}"), "pool3",
    match(name,"2B-VDI\d{3}"), "pool4",
    match(name,"3A-VDI\d{3}"), "pool5",
    match(name,"3B-VDI\d{3}"), "pool6",
    1=1, "unclassified"
)
| timechart span=1h count by vdi_pool

 This made the subsequent querys super easy.   Irritatingly within the dashboard, if I add a new value I need to update all of the queries - this vexes me greatly 😥

I have noticed the entire definition can be downloaded as a json doc - so Im tempted to start templating this in python - this does not seem sane - ideally I'd like to create blocks of repeatable logic I can assemble together to show different scenarios.

Anyone done anything similar to achieve this kind of capability - but more "splunkonic"? 

Labels (1)
0 Karma
1 Solution

splunkernator
Path Finder

have you got any good links?  else I'll just search 

View solution in original post

Tags (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

If this is reusable code, then it should be a macro - then if it changes, just change the macro definition and all uses of the macro will use the new definition.

0 Karma

splunkernator
Path Finder

have you got any good links?  else I'll just search 

Tags (1)
0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...