Hi,
i have a couple of logfiles where there is one important "field" that splunk does not recognize because it is not made of alphanumeric characters.
The possible values are "<<<<<" or "<====" indidicating if the logged event happened on the frontend or the backend. Which of course is important information inf finding an error.
How can i (best case) define a tag for this so i could label instances with either "frontend" or "backend"?
Regards Dom
e.g.:
props.conf:
[mysourcetype]
EXTRACT-end = (?<end>\<\<\<\<\<|\<====)
You will end up with a field "end" with the value either "<<<<<" or "<====" for each event. That's a little ugly, so you could define a lookup to make it look better:
props.conf:
[mysourcetype]
EXTRACT-end = (?<end>\<\<\<\<\<|\<====)
LOOKUP-endprettify = enddesc end OUTPUT enddesc
transforms.conf:
[enddesc]
filename = enddesc.csv
lookups/enddesc.csv:
end,enddesc
"<<<<<","frontend"
"<====","backend"
This will also allow you to search on enddesc="frontend"
, which will work the same as end="<<<<<"
e.g.:
props.conf:
[mysourcetype]
EXTRACT-end = (?<end>\<\<\<\<\<|\<====)
You will end up with a field "end" with the value either "<<<<<" or "<====" for each event. That's a little ugly, so you could define a lookup to make it look better:
props.conf:
[mysourcetype]
EXTRACT-end = (?<end>\<\<\<\<\<|\<====)
LOOKUP-endprettify = enddesc end OUTPUT enddesc
transforms.conf:
[enddesc]
filename = enddesc.csv
lookups/enddesc.csv:
end,enddesc
"<<<<<","frontend"
"<====","backend"
This will also allow you to search on enddesc="frontend"
, which will work the same as end="<<<<<"
You would use the "rex" command to do it similarly.
Ok, look nice enough. Will try it. At pure search time i.e. with the search language would interest me however. i'm new to the product so please ignore my ignorance 🙂