Add description to field value

phildefer — Tue, 14 Nov 2023 18:38:43 GMT

Hello,

I have a system log which contains different DNS error messages (in the 'Message' field) and I am looking for an easy way to provide a short, meaningful description for those messages, either by adding a new field representing each unique DNS error message, or by adding text to the Message field.

Here's an example; one event contains the following :
Message="DNS name resolution failure (sos.epdg.epc.mnc720.mcc302.pub.3gppnetwork.org)"

This error is related to WiFi calling, so I would like to associate a description, or tag to that specific message, e.g. "WiFi calling".

Thoughts?

Re: Add description to field value

bowesmana — Wed, 15 Nov 2023 01:51:47 GMT

Depending on how many cases you have, you can either do it inline, with

| eval description=case(match(Message, "regex_expression1"), "Description1", match(Message, "regex_expression2"), "Description2", match(Message, "regex_expression3"), "Description3")

or probably more practical is to make a lookup - probably a wildcard based lookup, which means creating a CSV with Message, Description fields and then a lookup DEFINITION that has the match type set to

WILDCARD(Message)

In that you could then put things like

"DNS name resolution failure*" as the Message column and then a suitable description.

Using a wildcard type means you don't have to write SPL to extract particular bits of the message to determine the lookup attribute.

topic Re: Add description to field value in Splunk Search

Add description to field value

Re: Add description to field value