Splunk Search
Highlighted

Propper Logging practices for list of events

Explorer

I have a service that recommends a list of cars based on the user's input of personal information. For example, someone can send a request containing personal information and my service will respond back with a list of cars suited for their needs/personality like so:

{
    "cars": [
        {
            "type": "chevrolet equinox"
        },
        {
            "type": "ford explorer"
        },
        {
            "type": "cadillac srx"
        },
    ]
}

I want to be able to log all the cars that we send out as recommendations so I can make a bar graph that represents the number of times we've recommended all the different types of cars.

My question is, what are the best practices in this case. How can we look it so that splunk will easily be able to pick this up and generate a bar graph with?

0 Karma
Highlighted

Re: Propper Logging practices for list of events

SplunkTrust
SplunkTrust

Making the entire event as one JSON object is a good way of letting Splunk easily understand arrays/lists, yes.

View solution in original post

Highlighted

Re: Propper Logging practices for list of events

Explorer

ok so would it be better to log it like this:

{
     "cars": ["chevrolet equinox","ford explorer","cadillac srx"]
 }
0 Karma
Highlighted

Re: Propper Logging practices for list of events

SplunkTrust
SplunkTrust

If you're only every going to store a string per car then that would be more efficient. If for example you might one day store the model year it'd be better to split that off into an object per car with properties manufacturer, model, year, etc.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.