Splunk Search

Skeltalog and iis log mapping

vaibhavbeohar
Path Finder

How can do mapping between two different source type say for exp. mapping between skelta log and iis log

Tags (1)
0 Karma

lguinn2
Legend

In order to correlate events between two different sourcetypes, you need to identify the common fields.
Here is an example:

The events of sourcetype myMiddleware have two fields (in addition to a timestamp, host, source and sourcetype)

username

userip

The events of sourcetype myDBMS have three fields (in addition to a timestamp, host, source and sourcetype)

transId

userId

statusCode

Let's say that you want to report the number of transactions (based on transId) for each ip address. In this example, the username and userId fields are really the same thing, they are just named differently in the different sourcetypes. The following search will address these problems:

sourcetype=myMiddleware OR sourcetype=myDBMS |
rename userId as username |
transaction username transId |
stats distinct_count(transId) As TransactionCount by userip 

I suggest that you play around with this and look at the Search Reference manual for more options and examples of these commands.

0 Karma

vaibhavbeohar
Path Finder

Exactly correlation between two sourcetype

0 Karma

lguinn2
Legend

Yes, what do you mean by "mapping"? Are you trying to correlate events between these two sourcetypes?

0 Karma

Ayn
Legend

More details, please.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!