topic Re: How do I group unstructured events based on errorcode that they contain in body? in Getting Data In

How do I group unstructured events based on errorcode that they contain in body?

dhirajnangar — Wed, 30 Sep 2020 03:58:03 GMT

I have some base splunk query which gives me list of events which has body mentioned below -

event 1.

{"Errors":{"Error":{"RequestId":"112314082","Source":"","ReasonCode":"MISSING_REQUIRED_INPUT","Description":"Missing Required Input","Recoverable":"false","Details":{"Detail":{"Name":"ErrorDetailCode","Value":"092000"}}}}}

event 2.

{"Errors":{"Error":{"RequestId":"112314082","Source":"","ReasonCode":"MISSING_REQUIRED_INPUT","Description":"Missing Required Input","Recoverable":"false","Details":{"Detail":{"Name":"ErrorDetailCode","Value":"092001"}}}}}

event 3.

{"Errors":{"Error":{"RequestId":"112314082","Source":"","ReasonCode":"MISSING_REQUIRED_INPUT","Description":"Missing Required Input","Recoverable":"false","Details":{"Detail":{"Name":"ErrorDetailCode","Value":"092000"}}}}}

event 4.
{"Errors":{"Error":{"RequestId":"112314082","Source":"","ReasonCode":"MISSING_REQUIRED_INPUT","Description":"Missing Required Input","Recoverable":"false","Details":{"Detail":{"Name":"ErrorDetailCode","Value":"092002"}}}}}

I need to group these events based on message body's ErrorDetailCode value.
e.g.
ErrorCode Count

092000 - 2
092001 - 1
092002 - 1

Can someone please help me or guide me to build as I am new to Splunk ?

Re: How do I group unstructured events based on errorcode that they contain in body?

nickhills — Thu, 30 Jan 2020 18:41:55 GMT

Hi @dhirajnangar try:

...your serach|rex field=_raw "ErrorDetailCode.+Value\":\"(?P<errorCode>\d+)" |stats count by errorCode

Re: How do I group unstructured events based on errorcode that they contain in body?

to4kawa — Fri, 31 Jan 2020 11:53:54 GMT

| makeresults
| eval _raw="{\"Errors\":{\"Error\":{\"RequestId\":\"112314082\",\"Source\":\"\",\"ReasonCode\":\"MISSING_REQUIRED_INPUT\",\"Description\":\"Missing Required Input\",\"Recoverable\":\"false\",\"Details\":{\"Detail\":{\"Name\":\"ErrorDetailCode\",\"Value\":\"092000\"}}}}}
{\"Errors\":{\"Error\":{\"RequestId\":\"112314082\",\"Source\":\"\",\"ReasonCode\":\"MISSING_REQUIRED_INPUT\",\"Description\":\"Missing Required Input\",\"Recoverable\":\"false\",\"Details\":{\"Detail\":{\"Name\":\"ErrorDetailCode\",\"Value\":\"092001\"}}}}}
{\"Errors\":{\"Error\":{\"RequestId\":\"112314082\",\"Source\":\"\",\"ReasonCode\":\"MISSING_REQUIRED_INPUT\",\"Description\":\"Missing Required Input\",\"Recoverable\":\"false\",\"Details\":{\"Detail\":{\"Name\":\"ErrorDetailCode\",\"Value\":\"092000\"}}}}}
{\"Errors\":{\"Error\":{\"RequestId\":\"112314082\",\"Source\":\"\",\"ReasonCode\":\"MISSING_REQUIRED_INPUT\",\"Description\":\"Missing Required Input\",\"Recoverable\":\"false\",\"Details\":{\"Detail\":{\"Name\":\"ErrorDetailCode\",\"Value\":\"092002\"}}}}}"
| eval raw=split(_raw,"
")
| mvexpand raw
| rename raw as _raw
`comment("this is your sample")`
`comment("From here, the logic")`
| spath path=Errors.Error.Details.Detail.Value output=ErrorCode
| stats count by ErrorCode

Hi, how about this?