Splunk Search

Propper Logging practices for list of events

sankarms
Explorer

I have a service that recommends a list of cars based on the user's input of personal information. For example, someone can send a request containing personal information and my service will respond back with a list of cars suited for their needs/personality like so:

{
    "cars": [
        {
            "type": "chevrolet equinox"
        },
        {
            "type": "ford explorer"
        },
        {
            "type": "cadillac srx"
        },
    ]
}

I want to be able to log all the cars that we send out as recommendations so I can make a bar graph that represents the number of times we've recommended all the different types of cars.

My question is, what are the best practices in this case. How can we look it so that splunk will easily be able to pick this up and generate a bar graph with?

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Making the entire event as one JSON object is a good way of letting Splunk easily understand arrays/lists, yes.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Making the entire event as one JSON object is a good way of letting Splunk easily understand arrays/lists, yes.

martin_mueller
SplunkTrust
SplunkTrust

If you're only every going to store a string per car then that would be more efficient. If for example you might one day store the model year it'd be better to split that off into an object per car with properties manufacturer, model, year, etc.

0 Karma

sankarms
Explorer

ok so would it be better to log it like this:

{
     "cars": ["chevrolet equinox","ford explorer","cadillac srx"]
 }
0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...