Splunk Search

Software application best practice for logging sets of tuples for Splunk

gregbujak
Path Finder

When you have control of the logging in an application, what is the recommendation to make things as easy as possible for Splunk to digest/report on sets of tuples?

What should the log event(s) look like and then what would the search look like if you want to know each individual type and count.

Specific example: I have a dynamically generated set containing types and counts - myset={(widgetA | 100), (widgetB | 200), (widgetC | 5)}

Short of printing each on a separate line, whats the simplest approach? Is the above a good format?


Having semantic logging that is expressed in key value pairs separated by "=" is bread and butter. The issue here is sets and dynamic membership where the "schema" of the tuple is defined by {(type, count)}. To make this more difficult, but no less relevant: imagine if your tuple was defined by {(type, count, successes, failures)}

Tags (3)
0 Karma
1 Solution

jtrucks
Splunk Employee
Splunk Employee

all key=value pair formats are auto extracted, so perhaps try:

widgetA=100 widgetB=200 widgetC=5

You could even have other fields that identify the app like:

appname=myappnamehere widgetA=100 widgetB=200 widgetC=5

Enjoy!

--
Jesse Trucks
Minister of Magic

View solution in original post

jtrucks
Splunk Employee
Splunk Employee

all key=value pair formats are auto extracted, so perhaps try:

widgetA=100 widgetB=200 widgetC=5

You could even have other fields that identify the app like:

appname=myappnamehere widgetA=100 widgetB=200 widgetC=5

Enjoy!

--
Jesse Trucks
Minister of Magic

gregbujak
Path Finder

Gents, thx for the response(s). There is actually some nuance to this that I don't think was communicated well. I have modified the question to reflect that.

0 Karma

emiller42
Motivator

Some added details: If the thing separating your pairs (in the above, the space and equals characters) could occur in your values, then quote them.

key=some_value key2="Some value" key3=12345 key4="prop1=foo prop2=bar"

Something like that will auto-extract very well with splunk, and you end up with:

key = some_value
key2 = Some value
key3 = 12345
key4 = prop1=foo prop2=bar
prop1 = foo
prop2 = bar
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...