topic Re: How to Use IF or Case condition in Splunk Search

How to Use IF or Case condition

alex5441 — Mon, 05 Apr 2021 17:31:12 GMT

Hi,

My logs are in following format:

{[-]

logger: .......

message: ..........

severity: Error

}

{[-]

exception: .........

logger: .......

message: ..........

severity: Error

}

my query is :

........| rex "\"exception\":\"(<ErrorMsg>.*?)\"" | table Application, ErrorMsg

The issue:

As some app logs have key "message" and some logs have both "exception" and "message".

How can I change my query that first it checks if there is key exception, if it does get the value of that key. If there is no Key exception check if there is key "message", if it does get the value of that.

My current query is able to get the value of exception (if I change exception to message, it gets the value of message. But trying to implement IF or CASE condition here)

Re: How to Use IF or Case condition

ITWhisperer — Mon, 05 Apr 2021 18:17:53 GMT

Try something like:

| rex "(\"exception\":\"(?<ErrorMsg>.*?)\"|\"message\":\"(?<Message>.*?)\")"

Re: How to Use IF or Case condition

alex5441 — Mon, 05 Apr 2021 19:03:54 GMT

Thank you ITWhisperer,

But I am getting error in compile:

Re: How to Use IF or Case condition

ITWhisperer — Mon, 05 Apr 2021 19:26:21 GMT

Try with different names as in my example