Splunk Enterprise

Reuse-able Pattern matching blocks for eval?

splunkernator
Path Finder

Code is easier to explain: I wanted a bunch of new categories and i found eval especially useful - here is an obfuscated example

| index=my_index CONNECTED source="/var/log/vmware/my_log.log" 
| eval vdi_pool=case(
    match(name,"1A-VDI\d{3}"), "pool1",
    match(name,"1B-VDI\d{3}"), "pool2",
    match(name,"2A-VDI\d{3}"), "pool3",
    match(name,"2B-VDI\d{3}"), "pool4",
    match(name,"3A-VDI\d{3}"), "pool5",
    match(name,"3B-VDI\d{3}"), "pool6",
    1=1, "unclassified"
)
| timechart span=1h count by vdi_pool

 This made the subsequent querys super easy.   Irritatingly within the dashboard, if I add a new value I need to update all of the queries - this vexes me greatly 😥

I have noticed the entire definition can be downloaded as a json doc - so Im tempted to start templating this in python - this does not seem sane - ideally I'd like to create blocks of repeatable logic I can assemble together to show different scenarios.

Anyone done anything similar to achieve this kind of capability - but more "splunkonic"? 

Labels (1)
0 Karma
1 Solution

splunkernator
Path Finder

have you got any good links?  else I'll just search 

View solution in original post

Tags (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

If this is reusable code, then it should be a macro - then if it changes, just change the macro definition and all uses of the macro will use the new definition.

0 Karma

splunkernator
Path Finder

have you got any good links?  else I'll just search 

Tags (1)
0 Karma
Get Updates on the Splunk Community!

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...