topic Re: String formating in Splunk Search

String formating

Satyapv — Mon, 11 Mar 2024 07:13:25 GMT

Hello All,

I have an Index = Application123 and it contains an Unique ID known as TraceNumber. For each Trace number we have Error's, Exceptions and return codes.

We have a requirements to summarize in a table Like below, If error is found in index need table value as YES if not found it should be No. Same for Exception if Exception is found then table should be Yes or else no. Note Error's, exceptions and retuncodes are in content of Index with field - Message log.

TraceNumber Error Exception ReturnCode

11111 YES NO YES

1234 YES NO YES

Any help would be appreciated

Re: String formating

gcusello — Mon, 11 Mar 2024 07:47:46 GMT

Hi @Satyapv,

let me understand: for each TraceNumber you can have Error="yes" (or something else) or Exception="yes" (or something else) and ReturnCode="yes" (or something else).You want in a table the TraceNumber and in different columns Error, Exception and ReturnCode ="yes" if there's something or "NO" if there's nothing, is it correct?

In this case, you have to use the fillnull command to give the values when there's no value, something like this:

index=Application123 TraceNumber=* | eval Error=if(Error="*","YES","NO"), Exception=if(Exception="*","YES","NO"), ReturnCode=if(ReturnCode="*","YES","NO") | table TraceNumber Error Exception ReturnCode

It's not clear fom me if the Error, Exception and ReturnCode fields are already extracted or not, if not, please share some sample so I can help you inextraction.

Ciao.

Giuseppe

Re: String formating

Satyapv — Tue, 12 Mar 2024 11:34:36 GMT

They are not extracted. They are part of log entries. Also is there a possibility to display complete Error or exception on last column?

TraceNumber Error Exception ReturnCode Complete/Error or Exception

11111 YES NO YES Full Exception....................................

1234 YES NO YES Full Error........................

Re: String formating

ITWhisperer — Tue, 12 Mar 2024 12:34:54 GMT

If they are not already extracted, you need to extract the trace number and error codes etc. If you need help with this, you will need to share some representative anonymised versions of your events, with details of what you want extracted e.g. what part of the event goes into which field.