How to compare two conditions in splunk query

vineela — Tue, 12 Jul 2022 13:55:19 GMT

Hi All,

I am trying to fetch events by comparing two conditions where i am unable to do that.
I have sample log like this:
[15:53:12.172] [WARN ] [] [c.c.n.t.e.i.T.ServiceCalloutEventData] [] - channel="null", productVersion="2FE1-5634ab725", apiVersion="V1", uuid="2Fedec2-16f0-4988-b1fa-68db0c565a9f", eventDateTime="2022-07-11T05:53:12.172Z", severity="WARN", code="ServfefrventData", component="wDEGG", category="integrational-eFsdal", serviceName="Details", eventName="_RESPONSE", message="CadfSFDresponse", start="1657518790580", stop="1657518792172", elapsed="1592", exceptionInfo="null", url="https://scdssfg.com/npp-mms/v1/mandates/actions/DVd", httpResponseCode="500", priority="NORM", servicingAgentBIC="CTBAAUSNXXX", swiftMessagePartnerBIC="RESTMP1", messageIdentification="beb727a900dd11edaf1a69ae7e224ce5", mandateIdentification="111536a1519111ec9bb20e6904f27a9e", returnCode="APS.API.6544"

I need to fetch all the events with all httpstatuscode and compare with returncode and then decide the severity type.
For all statuscode type cannot differ but for only 500(httpstatus code)based on returncode the severitytype would differ.
So i need to write query for httpstatus code when it hits 500 it has to check return code and for remaining no need to check any returncode.

index=a_audit |rex field=log "eventName=\"*(?<eventName>[^,\"\s]+)"|rex field=log "serviceName=\"*(?<serviceName>[^\"]+)"|rex field=log "severity=\"*(?<severity>[^\"]+)"|rex field=log "exceptionInfo=\"*(?<exceptionInfo>[^\"]+)"|rex field=log "httpResponseCode=\"*(?<httpResponseCode>[^\"]+)"|rex field=log "returnCode=\"*(?<returnCode>[^\"]+)"|stats count by eventName serviceName severity exceptionInfo httpResponseCode returnCode|search serviceName="Details" AND eventName="RESPONSE" AND (severity=ERROR OR severity=WARN) |eval severityType=(httpResponseCode=400 OR httpResponseCode=401 OR httpResponseCode=403 OR httpResponseCode=404 "FATAL") AND (httpResponseCode=500 IN (returnCode=APS.API.6544) |where count>1

i cant able to compare 2 conditions for same field.Can you help me on the same.

Re: need to compare two conditions in splunk query

ITWhisperer — Tue, 12 Jul 2022 07:54:34 GMT

This is a bit confusing - are you trying to set severityType to FATAL if response code is one of the 400 codes or 500 and return code is a particular value?

| eval severityType=if(httpResponseCode=400 OR httpResponseCode=401 OR httpResponseCode=403 OR httpResponseCode=404 OR (httpResponseCode=500 AND returnCode="APS.API.6544"), "FATAL", "NOT FATAL")

topic Re: need to compare two conditions in splunk query in Monitoring Splunk

How to compare two conditions in splunk query

Re: need to compare two conditions in splunk query