topic Re: Extracting record which is not success after few retry. in Splunk Search

Extracting record which is not success after few retry.

Nilesh067 — Thu, 22 Oct 2020 18:08:16 GMT

I have below log message :
basically it is for creating customer record and if we got error the we are retrying for 5 times to get succeed.

log message-------------

Error while creating record for customer id : 94ABGH0048

Error while creating record for customer id : 94ABGH0048

Successfully created record for customer id : 94ABGH0048

Error while creating record for customer id : 902SDKK720

Successfully created record for customer id : 945TTFK048

can i get those customer id for which record not created Successfully ?

according to above log message output should be "902SDKK720"

Re: Extracting record which is not success after few retry.

kennetkline — Thu, 22 Oct 2020 19:00:40 GMT

1. extract the last status code by customer id I wasn't sure field in your search so used _raw

| rex field=_raw "^(?<statuscode>[a-zA-Z]+)\s|customer\sid\s+:\s(?<customerid>[0-9A-Z]+)"
| stats last(statuscode) by customerid

2. if understanding you correctly; you wanted any customer id's (where the last code is a failure, didn't aks to validate file 5 events but could do that too.