topic Re: How do I make a Splunk query that reads all error code , it's message and count? in Getting Data In

How do I make a Splunk query that reads all error code , it's message and count?

gauravepi — Tue, 06 Nov 2018 16:34:25 GMT

I have a JSON response now, and, from that, i want to create a table that will have all Unique Error Codes, Messages and Count . I am not able to read the JSON message in Splunk. How can we do this in Splunk? Below is one sample JSON response which i have

level:   DEBUG  
line:    43 
logger:  ErrorUtils 
message: Error: {"ErrorCode":"201","Message":"Invalid User"}

I have created a query just to read the eventtype. i am not sure how i can proceed further on this.

eventtype="myevent"

Re: How do I make a Splunk query that reads all error code , it's message and count?

Rob2520 — Wed, 07 Nov 2018 20:59:50 GMT

Can you share your whole JSON event?

Re: How do I make a Splunk query that reads all error code , it's message and count?

pramit46 — Thu, 08 Nov 2018 09:59:19 GMT

Assuming your json is properly formatted, try setting KV_Mode=json in your props.conf file against that sourcetype. It should automatically extract the field values from the json events.

You can read more about it here:
https://docs.splunk.com/Documentation/Splunk/latest/admin/Propsconf

Let me know if that helps.