Splunk Search

Reading an Environment Regkey and using in Searches

jeffbat
Path Finder

I am trying to figure out the best way to utilize a regkey we set on Windows server which indicates the Environment the server is for.  And then being able to use that to help limit the returned search events to that type of Environment.

Meaning, we have the regkey set on our test servers as test.  So i would like to be able to set something like and eventtype or tag or some other simple way where I can read that regkey on all of our Windows servers and when users go to search they could do something like:

host=web* eventtype=test

And all of the events for the test servers would be show in the timeframe. 

And if a user instead did the search:

host=web* eventtype=preprod

It would show all of the event for the preprod servers.

This does not HAVE to be an eventtype but just using that as a field which is indicating the registry key value without having to create some extra search just for that every time as a user.  

The reading of the regkey should also be such that if a server has the regkey changed from test to preprod then that is picked up and going forward the server would show as preprod.

We use to use an eventtype that was basically equal to host="*PP*" but our servers now are getting more random names so that no longer will work.

Thanks.

Labels (1)
Tags (3)
0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...