topic Re: Combine multiple Regex rules into single search query in Splunk Search

How to combine multiple regex rules into single search query?

alwinaugustin — Tue, 22 Nov 2022 14:30:42 GMT

I have the following search queries:

API Error Alert --------------- index=myindex sourcetype=my-app:app |spath message | regex message="^.*Error while creating account.*$" |dedup my_id_field API Down Alert --------------- index=myindex sourcetype=my-app:app | spath message | regex message="^.*api-down.*$" | dedup my_id_field Update API Error ------------------ index=myindex sourcetype=my-app:app | spath message | regex message="^.*Error while updating trial account.*$" | dedup my_id_field

I have some more of the same kind. It is checking against multiple messages using. regular expressions. Now I would like to create an email alert for all these events and would like combine all these into one query and so I can create a single alert rather than creating individual alerts. How can I combine these queries ? It should trigger the email alert if any of these conditions is true. I have tried the following, but it is not working.

index=myindex sourcetype=my-app:app |spath message | regex message="^.*Error while creating account.*$" | regex message="^.*api-down.*$"|regex message="^.*Error while updating trial account.*$" |regex message="^.*JWT Token creation failed with error.*$" |regex message="^.*Error while fetching IPLookU.*$"

Re: Combine multiple Regex rules into single search query

bowesmana — Tue, 22 Nov 2022 07:24:57 GMT

Use where clause rather than regex

index=myindex sourcetype=my-app:app | spath message | where match(message, "^.*Error while creating account.*$") OR match(message, "^.*api-down.*$") OR match(message, "^.*Error while updating trial account.*$") OR match(message, "^.*JWT Token creation failed with error.*$") OR match(message, "^.*Error while fetching IPLookU.*$")

Re: Combine multiple Regex rules into single search query

ITWhisperer — Tue, 22 Nov 2022 07:56:37 GMT