I'm trying to retrieve some log metadata and associate them to all my events.
When my application starts, I'll get a few lines with what I'm calling metadata here (version, env, user, ... ) and then, the raw logs start.
I want this Version and Env to be usable as a field in all my events.
Like if each event looked something like this from a sub-query search standpoint:
What would be the solution to end up with such usage?
The application I want to monitor is a heavy client, the users can choose the environnement to connect to from their desktop, and I capture the logs via a UniversalForwarder to Splunk Cloud.
I don't have much control on the log format, I've to go with this one.
Thanks in advance for your help
| rex "(?<verenv>Version:\d\.\d;Env=\w+)"
| streamstats last(verenv) as lastverenv
| eval lastverenv=if(lastverenv=verenv,null,"|".lastverenv)
| eval _raw=_raw.lastverenv
View solution in original post