Splunk Search

Add 'static' field to all events from a source (syslogs)

tskimball
New Member

I have a dedicated index for syslogs that I would like to add a 'static field' to:

MonFunc=sysmsgs ### Add to all events in this index

I'm trying to merge this data with related info in another logging index (which has a field extract for various function errors, generating the MonFunc). But, doing an aggregate table-based summary (from all indexes), grouped by MonFunc, has all the syslogs showing up as NULL.

I know of one possible workaround (our monitor system has its own filter and log, adding its own msg before the actual syslog), but would prefer a 'simpler' solution than generating a custom syslog extractor. It would also end up bypassing other data that may be useful long-term, which I'm trying to avoid.

0 Karma
1 Solution

hazekamp
Builder

To add a static kv pair to all events in an index I would recommend using a lookup table to map index->MonFunc. The trick is to use a global (no stanza) property unless you can scope to a particular source/sourcetype/host. I didn't find the name of your index, so be sure to change "index_name" to reflect the name of the index you want to assign the kv pair to:

## MonFunc.csv
index,MonFunc
index_name,sysmsgs

## transforms.conf
[MonFunc_lookup]
filename = MonFunc.csv

## props.conf
LOOKUP-MonFunc_for_index_name = MonFunc_lookup index OUTPUT MonFunc

View solution in original post

0 Karma

davecroto
Splunk Employee
Splunk Employee

Devise a common sourcetype

example lookup csv called myexample.csv

sourcetype,SLA,NAME,VALUE
foobar,99,TechnicalError,456

transforms.conf:

[myexamplelookup]
filename=myexample.csv

props.conf
[foobar]
LOOKUP-myexamplelookup = myexamplelookup sourcetype VALUE OUTPUT SLA NAME VALUE

0 Karma

tskimball
New Member

This is for adding an (already defined) field that shows what function the message came from.

In the case of our monitoring app, all syslogs come from a function named 'sysmsgs.' Setting that field for all incoming syslogs will help prevent confusion for our end users.

0 Karma

hazekamp
Builder

To add a static kv pair to all events in an index I would recommend using a lookup table to map index->MonFunc. The trick is to use a global (no stanza) property unless you can scope to a particular source/sourcetype/host. I didn't find the name of your index, so be sure to change "index_name" to reflect the name of the index you want to assign the kv pair to:

## MonFunc.csv
index,MonFunc
index_name,sysmsgs

## transforms.conf
[MonFunc_lookup]
filename = MonFunc.csv

## props.conf
LOOKUP-MonFunc_for_index_name = MonFunc_lookup index OUTPUT MonFunc
0 Karma

tskimball
New Member

Excellent, that worked. Thanks.

0 Karma

netwrkr
Communicator

Are you simply trying to insert a placeholder field which will be later defined by other query?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...