Logging examples in an app or add-on for Splunk Enterprise

 In this example of what not to do, the term "error" is too vague and the keys must be assigned to the values because they are not provided:

BAD:

Log.debug("error %d 454 - %s", userId, transId)

In this improved version, the event is easier to parse because the key-value pairs are clearly provided. Searching on "orderstatus=error" will retrieve exactly the events you want. Also, you can query Splunk for reports that use orderstatus, such as requesting its distribution (for example, completed=78%, aborted=21%, error=1%), which is something you couldn't do if you only had the keyword "error" in your log event.

GOOD:

Log.debug("orderstatus=error, errorcode=454, user=%d, transactionid=%s", userId, transId)

Break up multi-value information

Parsing this multi-value event is difficult and so is adding data for each value of app:

BAD:

<TS> phonenumber=333-444-4444, app=angrybirds,facebook

This improved version breaks multi-value information into separate events, so the key-value pairs are more clear:

GOOD:

<TS> phonenumber=333-444-4444, app=angrybirds, installdate=xx/xx/xx
<TS> phonenumber=333-444-4444, app=facebook, installdate=yy/yy/yy

Use headings as keys

You can use headings as keys, as shown in the following example. The Splunk platform can interpret the column headers as keys and each line as values (although this does break the rule about avoiding multi-line events):

<TS>
USER PID %CPU %MEM VSZ RSS TT STAT STARTED TIME COMMAND
Root 41 21.9 1.7 3233968 143624 ?? Rs 7Jul11 48:09.67 /System/Library/foo
Rdas 790 4.5 0.4 4924432 32324 ?? S 8Jul11 9:00.57 /System/Library/baz

Use multiple unique IDs to connect events

If you can't use one unique identifier, use a transitive connection from one event to another. For example, here are three separate events:

Event A: transid=abcdef
Event B: transid=abcdef, otherid=qrstuv
Event C: otherid=qrstuv

You can associate Event A with Events B and C, because of the connection between the two IDs in Event B.

Comments

Post a Comment

Popular posts from this blog

Terraform

Image
  Terraform is an infrastructure as code tool that lets you build, change, and version cloud and on-prem resources safely and efficiently. HashiCorp Terraform is an infrastructure as code tool that lets you define both cloud and on-prem resources in human-readable configuration files that you can version, reuse, and share. You can then use a consistent workflow to provision and manage all of your infrastructure throughout its lifecycle. Terraform can manage low-level components like compute, storage, and networking resources, as well as high-level components like DNS entries and SaaS features. How does Terraform work? Terraform creates and manages resources on cloud platforms and other services through their application programming interfaces (APIs). Providers enable Terraform to work with virtually any platform or service with an accessible API. HashiCorp and the Terraform community have already written  thousands of providers  to manage many different types of resources and services.
Read more

Scrum Master Interview help - Bootcamp

Understanding the MoSCoW prioritization | How to implement it into your project Projects, irrespective of their size or complexity, often juggle numerous tasks and requirements. In such a scenario,  MoSCoW prioritization  becomes essential to ensure the successful completion of the project.  Besides, it is also a very effective way to manage project priorities. With a straightforward and adaptable approach, the MoSCoW method helps manage stakeholder expectations and improve project outcomes. What is the MoSCoW prioritization technique?  The MoSCoW method is a prioritization matrix widely used in project management and software development. The term MoSCoW is an acronym that stands for  Must have ,  Should have ,  Could have , and  Won’t have , each denoting a level of priority. Here is the breakdown of the MoSCoW method:  Must have:  These are critical requirements that the project cannot be completed without them. If these are not fulfilled, the project is con
Read more

Kubernetes

  Using containers to host applications and other processes has gone mainstream. As more and more workload is moved into containers, management systems are needed to handle the demands of containerized applications at scale. One of the most popular options for managing  container-based workload is Kubernetes . Kubernetes combines container management automation with an extensible API to create a cloud-native application management powerhouse. At its core, Kubernetes manages the placement of pods, which can consist of one or more containers, on a Kubernetes cluster node. Additionally, if one of these pods crashes, Kubernetes can create a new instance of it. If a cluster node is removed, Kubernetes can move any affected workload to a different node in the cluster. On top of that, Kubernetes pods can be scaled to provide more or less throughput to meet scale demands and these scale operations can be triggered manually or automatically using Kuberentes horizontal pod auto-scaling. Finally,
Read more