I am trying to figure out the best way to utilize a regkey we set on Windows server which indicates the Environment the server is for. And then being able to use that to help limit the returned search events to that type of Environment.
Meaning, we have the regkey set on our test servers as test. So i would like to be able to set something like and eventtype or tag or some other simple way where I can read that regkey on all of our Windows servers and when users go to search they could do something like:
host=web* eventtype=test
And all of the events for the test servers would be show in the timeframe.
And if a user instead did the search:
host=web* eventtype=preprod
It would show all of the event for the preprod servers.
This does not HAVE to be an eventtype but just using that as a field which is indicating the registry key value without having to create some extra search just for that every time as a user.
The reading of the regkey should also be such that if a server has the regkey changed from test to preprod then that is picked up and going forward the server would show as preprod.
We use to use an eventtype that was basically equal to host="*PP*" but our servers now are getting more random names so that no longer will work.
Thanks.
