topic Splunk search error in Alerting

Splunk search error

Kuldeep — Tue, 09 Nov 2021 13:33:29 GMT

Hi Team,

1) I am searcing for APPAP100E cyber ark keyword error in splunk.

we are not getting output .

2) I am searching for LicenseVerifier perticular word but not getting output.

3) I am searching for SSLHandshakeException error but not getting event details output in splunk UI.4

please help & guide to resolve.

Thanks and regards

ITWhisperer — Tue, 09 Nov 2021 16:06:38 GMT

What search commands have you tried so far?

Kuldeep — Tue, 09 Nov 2021 16:17:37 GMT

1) index = index name source="/opt/middleware/appian/logs/tomcat-stdOut.log" APPAP100E |

2) index = index name source="/opt/middleware/appian/logs/tomcat-stdOut.log" LicenseVerifier |

3) index = index name source="/opt/middleware/appian/logs/tomcat-stdOut.log" SSLHandshakeException |

these three

ITWhisperer — Tue, 09 Nov 2021 16:37:43 GMT

Can you share some raw events which appear in the log which are and are not matching your searches?

Kuldeep — Tue, 09 Nov 2021 17:11:21 GMT

I getting search 0 event result.

ITWhisperer — Tue, 09 Nov 2021 18:03:19 GMT

What do you get if you search the index and source without any other search conditions?