topic Re: If / Then Conditional. in Splunk Search

If / Then Conditional.

codichulo — Tue, 18 Aug 2020 04:24:01 GMT

Heres what i'm trying to accomplish:

requestID status
123456 errored
321654 Success
789456 errored

I'm Newbie, Maybe i'm going about this all wrong, and there maybe another way....but i don't think so based on what info i have. but heres what i got so far. I'm probably over-thinking this.

index=someindex sourcetype=sometype "request syntax" OR "error syntax" OR "success syntax"
| rex field=_raw "request id: '(?<requestID>\d+)',\text"
| rex field=_raw ".*(?<error>Error response received)\stext"
| rex field=_raw ".*(?<Success>Database request executed):\stext"
| eval requestID =if(requestID=(error),"Errored", "Success")

Re: If / Then Conditional.

to4kawa — Tue, 18 Aug 2020 05:13:54 GMT

what's the logs.
your regex is not good.

Re: If / Then Conditional.

bowesmana — Tue, 18 Aug 2020 05:16:31 GMT

There are a couple of oddities/errors in your query, e.g. there is no 's' after the \ in the request ID rex statement and the if statement would not need the () round error, however, it depends on your data as to what your query should look like - can you provide a sample?

However, from your example query, this might be better (I have removed the trailing data outside the field capture group

index=someindex sourcetype=sometype "request syntax" OR "error syntax" OR "success syntax" | rex field=_raw "request id: '(?<requestID>\d+)'" | rex field=_raw ".*(?<error>Error response received)" | rex field=_raw ".*(?<Success>Database request executed)" | eval status=if(requestID=error,"Errored", "Success")

this is assuming that the rex statement extracting the field 'error' will give the same value as the requestID field. What is your intention with Success field extraction

Re: If / Then Conditional.

codichulo — Tue, 18 Aug 2020 13:21:40 GMT

oh sorry, the rex statements are working fine, i just removed identifiable info to make them look generic, and in doing so made them look in error.

it was the eval statement that i couldn't get to work right. I'll try your suggestion. Thanks so much.