topic Re: Dashboard creation in Dashboards & Visualizations

Dashboard creation

splunk6 — Fri, 05 Jul 2024 15:08:59 GMT

I have a xml response in splunk whenever i query a index.I used to get the error msg in

</soap:Envelope>", RESPONSE="<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"> <soapenv:Header/> <soapenv:Body> <soapenv:Fault xmlns:trefault="http://tresoap.intecbilling.com/fault/2.0"> <faultcode>trefault:ApplicationException</faultcode> <faultstring><CM-41398> ERROR: Value "Apple Watch 4G 5GB" supplied for Fact "OrderedComp.RatePlan_R" is not allowed by the fact's filter search or expression</faultstring> <detail> <trefault:Detail> <trefault:Message><CM-41398> ERROR: Value "Apple Watch 4G 5GB" supplied for Fact "OrderedComp.RatePlan_R" is not allowed by the fact's filter search or expression</trefault:Message> <trefault:ErrorId>41398</trefault:ErrorId> </trefault:Detail> </detail> </soapenv:Fault> </soapenv:Body>

Can someone tell me how to extract this error msg from the xml and display the error msg in a seperate panel as table in dashboard

Re: Dashboard creation

richgalloway — Fri, 05 Jul 2024 15:53:02 GMT

Use the spath command to parse the XML then select the desired field. If spath doesn't work, it's because the XML is not valid. You may need to strip out excess quotes.

Re: Dashboard creation

splunk6 — Fri, 05 Jul 2024 22:32:49 GMT

if i give the below query to extract the error msg alone from the soap response:

index="abcl" sourcetype="oracle:transactionlog" OPERATION = "getOrderService" |rex "REQUEST=\"(?<REQUEST>.+)\", RESPONSE=\"(?<RESPONSE>.+)\", RETRYNO" |spath input=RESPONSE |spath input=RESPONE output=trefault:Message path=trefault:Message

am getting no response

Re: Dashboard creation

richgalloway — Fri, 05 Jul 2024 21:43:35 GMT

There are no results because the rex command is not extracting any fields. That's because it is looking for text ("REQUEST" and "RETRYNO") that don't exist (at least not in the sample event). This run-anywhere query works for me.

| makeresults | eval _raw="</soap:Envelope>\", RESPONSE=\"<soapenv:Envelope xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\"> <soapenv:Header/> <soapenv:Body> <soapenv:Fault xmlns:trefault=\"http://tresoap.intecbilling.com/fault/2.0\"> <faultcode>trefault:ApplicationException</faultcode> <faultstring><CM-41398> ERROR: Value "Apple Watch 4G 5GB" supplied for Fact "OrderedComp.RatePlan_R" is not allowed by the fact's filter search or expression</faultstring> <detail> <trefault:Detail> <trefault:Message><CM-41398> ERROR: Value "Apple Watch 4G 5GB" supplied for Fact "OrderedComp.RatePlan_R" is not allowed by the fact's filter search or expression</trefault:Message> <trefault:ErrorId>41398</trefault:ErrorId> </trefault:Detail> </detail> </soapenv:Fault> </soapenv:Body>" |rex "RESPONSE=\\\"(?<RESPONSE>.+)" |spath input=RESPONSE |spath input=RESPONSE output=trefault:Message path=soapenv:Envelope.soapenv:Body.soapenv:Fault.faultstring.detail.trefault:Detail.trefault:Message

Re: Dashboard creation

splunk6 — Fri, 05 Jul 2024 20:08:34 GMT

when i run the above query, am getting "invalid arguement near innisbrook"

Re: Dashboard creation

richgalloway — Fri, 05 Jul 2024 21:43:53 GMT

Weird typo is fixed.

Re: Dashboard creation

splunk6 — Sat, 06 Jul 2024 09:26:03 GMT

but then also its fetching all the responses from the results instead of faultstring only it s not filtering out the responses based on that tag

Re: Dashboard creation

splunk6 — Sat, 06 Jul 2024 12:05:38 GMT

i want the error messgae from "faultstring" to be displayed in my results:

</soap:Envelope>", RESPONSE="<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"> <soap:Header></soap:Header> <soap:Body> <soap:Fault> <faultcode>soap:Server</faultcode> <faultstring>APPL0014: IO Exception: Read timed out java.net.SocketTimeoutException: Read timed out</faultstring> </soap:Fault> </soap:Body>

My splunk query is below:

index="abc" source="xyz" OPERATION = "getOrderService" |rex "RESPONSE=\\\"(?<RESPONSE>.+)" |spath input=RESPONSE |spath input=RESPONSE output=faultstring path=soapenv:Envelope.soap:Header.soapenv:Body.soapenv:Fault.faultcode.faultstring

instead of fetching only one response with faultstring, its fetching all the results from the responses

Re: Dashboard creation

richgalloway — Sat, 06 Jul 2024 11:51:32 GMT

That's what Splunk does - it fetches all of the events that meet the search criteria. If you want a single response then put that in the SPL using head 1, tail 1, dedup or something similar.