Splunk Search

How to assign fields to event/logs which do not contain target string

JpAnderson_2
New Member

I have two applications, these can exist in preprod or live environments. I want to have a field on logs from both applications called "environment", which is set to LIVE if it is in the live environment.

Using field extractions I am able to extract whether a URI is from a live or preprod server for Application A by extracting LIVE when it appears in the URI and putting it into a field. This is easy as LIVE URIs include the string LIVE.

regex to match start of URI... (?P(?i)(LIVE))

For Application B it is different, PREPROD URIs are marked PREPROD, and LIVE versions are unmarked. However, for consistency between applications, I'd like to put a live field on to the live URIs. As there is no longer a 'LIVE' string to extract from the live URIs (live URIs for this app are shown by a lack of PREPROD), I'm not sure how to do this with a regex field extraction. I need to basically detect logs which do not contain preprod, and create a new field on them, named environment, populated with the value 'live'.

0 Karma

DalJeanis
Legend

Okay, it can be done. Extractions are not really designed to be "programmed", but you can usually make it happen.

There may be a more elegant way, but as long as you can get the rules to operate in this exact order, then here's some pseudocode on how you can do it, in four rules.

1) extract the appname
2) if appname matches app A, set environment to PREPROD
3) if appname matches app B, set environment to LIVE
4) if URI contains LIVE or PREPROD, set environment to that value

0 Karma

JpAnderson_2
New Member

Thanks for the answer. Is this all done with field extractions? For example how would I do step 1, set environment in the same extraction which sets the app name?

0 Karma

DalJeanis
Legend

How are you distinguishing between log records that come from one application and those that come from the other? Do they have different sourcetypes, or another major distinguishing characteristic at index time?

0 Karma

JpAnderson_2
New Member

There is another field for app_name extracted in a series of separate field extractions. It is extracted from the URI in an IIS log.

0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...