Splunk Search

Reading an Environment Regkey and using in Searches

jeffbat
Path Finder

I am trying to figure out the best way to utilize a regkey we set on Windows server which indicates the Environment the server is for.  And then being able to use that to help limit the returned search events to that type of Environment.

Meaning, we have the regkey set on our test servers as test.  So i would like to be able to set something like and eventtype or tag or some other simple way where I can read that regkey on all of our Windows servers and when users go to search they could do something like:

host=web* eventtype=test

And all of the events for the test servers would be show in the timeframe. 

And if a user instead did the search:

host=web* eventtype=preprod

It would show all of the event for the preprod servers.

This does not HAVE to be an eventtype but just using that as a field which is indicating the registry key value without having to create some extra search just for that every time as a user.  

The reading of the regkey should also be such that if a server has the regkey changed from test to preprod then that is picked up and going forward the server would show as preprod.

We use to use an eventtype that was basically equal to host="*PP*" but our servers now are getting more random names so that no longer will work.

Thanks.

Labels (1)
Tags (3)
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...