Splunk Search

Skeltalog and iis log mapping

vaibhavbeohar
Path Finder

How can do mapping between two different source type say for exp. mapping between skelta log and iis log

Tags (1)
0 Karma

lguinn2
Legend

In order to correlate events between two different sourcetypes, you need to identify the common fields.
Here is an example:

The events of sourcetype myMiddleware have two fields (in addition to a timestamp, host, source and sourcetype)

username

userip

The events of sourcetype myDBMS have three fields (in addition to a timestamp, host, source and sourcetype)

transId

userId

statusCode

Let's say that you want to report the number of transactions (based on transId) for each ip address. In this example, the username and userId fields are really the same thing, they are just named differently in the different sourcetypes. The following search will address these problems:

sourcetype=myMiddleware OR sourcetype=myDBMS |
rename userId as username |
transaction username transId |
stats distinct_count(transId) As TransactionCount by userip 

I suggest that you play around with this and look at the Search Reference manual for more options and examples of these commands.

0 Karma

vaibhavbeohar
Path Finder

Exactly correlation between two sourcetype

0 Karma

lguinn2
Legend

Yes, what do you mean by "mapping"? Are you trying to correlate events between these two sourcetypes?

0 Karma

Ayn
Legend

More details, please.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...