Splunk Search

How to use metadata/header for all the following events

Flobzh
Engager

Dear all,

I'm trying to retrieve some log metadata and associate them to all my events.

Exemple: 

When my application starts, I'll get a few lines with what I'm calling metadata here (version, env, user, ... ) and then, the raw logs start.

2021-05-10T09:53:21.122+02:00|Criticity=INFO|Message=Version:3.4;Env=production

2021-05-10T09:53:46.474+02:00|Criticity=INFO|Message=blabla
2021-05-10T09:53:46.474+02:00|Criticity=DEBUG|Message=blabla2
2021-05-10T09:53:46.478+02:00|Criticity=DEBUG|Message=blabla3

I want this Version and Env to be usable as a field in all my events.

Like if each event looked something like this from a sub-query search standpoint:

2021-05-10T09:53:46.474+02:00|Criticity=INFO|Message=blabla|Version:3.4;Env=production
2021-05-10T09:53:46.474+02:00|Criticity=DEBUG|Message=blabla2|Version:3.4;Env=production
2021-05-10T09:53:46.478+02:00|Criticity=DEBUG|Message=blabla3|Version:3.4;Env=production

What would be the solution to end up with such usage?

Context:

The application I want to monitor is a heavy client, the users can choose the environnement to connect to from their desktop, and I capture the logs via a UniversalForwarder to Splunk Cloud.

I don't have much control on the log format, I've to go with this one.

Thanks in advance for your help

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| rex "(?<verenv>Version:\d\.\d;Env=\w+)"
| streamstats last(verenv) as lastverenv
| eval lastverenv=if(lastverenv=verenv,null,"|".lastverenv)
| eval _raw=_raw.lastverenv

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex "(?<verenv>Version:\d\.\d;Env=\w+)"
| streamstats last(verenv) as lastverenv
| eval lastverenv=if(lastverenv=verenv,null,"|".lastverenv)
| eval _raw=_raw.lastverenv
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...