topic Re: Splunk Log data Enrichment in notifications in Getting Data In

Splunk Log data Enrichment in notifications

maheswar6523 — Tue, 29 Sep 2020 20:33:08 GMT

I have logs loaded to splunk, I created few alerts to send the error email notifications
till this it is working fine.., only one bottleneck here is they don't want whole error msg
in the email instead then need only meaning ful msg say example:"error_Num:4006 "Duplicate
document created" like this.., before that error_Num:4006 "this is occurred due to the user created
a document with the same name at logs c:/apps/oop"

I created a .csv file and uploaded with 2 perameters:
Error_num, Desc
4006,Duplicate document created
9002,Invalid login

When i user in the serach as |Inputlookup Error_num Outputlookup Desc
this is not working .., pls help in this

Re: Splunk Log data Enrichment in notifications

renjith_nair — Thu, 19 Jul 2018 13:51:49 GMT

if the error code and the message are already part of your event, then you could just extract the information and send only required field.

For e.g.

| makeresults |eval string="this is occurred due to the user created a document with the same name at logs c:/apps/oop error_Num:4006 Duplicate document created" 
|rex field=string "^(?:[^:\n]*:){2}\d+\s+(?P<message>.+)" |table message

You shall use the Splunk Field Extractor to extract the messages

Re: Splunk Log data Enrichment in notifications

woodcock — Thu, 19 Jul 2018 14:51:52 GMT

Like this

Your Existing Search For Alerts Here
| lookup YourLookupFileHere.csv Error_num OUTPUT Desc