Splunk Search

Skeltalog and iis log mapping

Path Finder

How can do mapping between two different source type say for exp. mapping between skelta log and iis log

Tags (1)
0 Karma


In order to correlate events between two different sourcetypes, you need to identify the common fields.
Here is an example:

The events of sourcetype myMiddleware have two fields (in addition to a timestamp, host, source and sourcetype)



The events of sourcetype myDBMS have three fields (in addition to a timestamp, host, source and sourcetype)




Let's say that you want to report the number of transactions (based on transId) for each ip address. In this example, the username and userId fields are really the same thing, they are just named differently in the different sourcetypes. The following search will address these problems:

sourcetype=myMiddleware OR sourcetype=myDBMS |
rename userId as username |
transaction username transId |
stats distinct_count(transId) As TransactionCount by userip 

I suggest that you play around with this and look at the Search Reference manual for more options and examples of these commands.

0 Karma

Path Finder

Exactly correlation between two sourcetype

0 Karma


Yes, what do you mean by "mapping"? Are you trying to correlate events between these two sourcetypes?

0 Karma


More details, please.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!