topic Re: Status Field Showing Both the values in same field? in Splunk Search

Status Field Showing Both the values in same field?

karthi2809 — Thu, 09 May 2024 17:08:33 GMT

Hi All,

This the query which i try to get status.But in the table its shows both error and success.PFA screenshot

| eval Status=case(priority="ERROR" AND tracePoint="EXCEPTION" OR message="*Error while processing*","ERROR", priority="WARN","WARN",priority!="ERROR" AND tracePoint!="EXCEPTION" OR message!="*(ERROR):*","SUCCESS") |stats values(Status) as Status by transactionId

Re: Status Field Showing Both the values in same field?

ITWhisperer — Thu, 09 May 2024 16:59:24 GMT

This is because the transaction ids have events with both sorts of status. If you just want the latest, you could try something like this

|stats latest(Status) as Status by transactionId

Re: Status Field Showing Both the values in same field?

karthi2809 — Thu, 09 May 2024 17:12:13 GMT

If i use some of the transactionID is error but some of its showing as Success.If the priority=error and exception="error" but the status is SUCCESS.I dont know y.

Re: Status Field Showing Both the values in same field?

ITWhisperer — Thu, 09 May 2024 17:17:13 GMT

Please provide some anonymised representative events which demonstrate the issue you are facing, what results you are getting, and your expected results.

Re: Status Field Showing Both the values in same field?

karthi2809 — Thu, 09 May 2024 17:28:41 GMT

Based on priority field and tracepoint field i am getting the status field.If priority is error and tracepoint as exception then i set status as per the keyword.But in some case its showing both ERROR and SUCCESS.

Message	priority	tracepoint
After Common SFTP Get File List Response	INFO	AFTER_REQUEST
After Common SFTP Get File List Response	INFO	AFTER_REQUEST
Before Common SFTP Get File Data Request	INFO	BEFORE_REQUEST
Before Common SFTP Get File List Request	INFO	BEFORE_REQUEST
Before Common SFTP Archive File Request	INFO	BEFORE_REQUEST
File Upload Request for BEFORE_REQUEST	INFO	BEFORE_REQUEST
File Upload to in SFTP mode. >>> END	INFO	END
		END
File Upload Request for f	ERROR	EXCEPTION
Error while trying to upload file to GCP from Common SFTP	ERROR	EXCEPTION
DEV(ERROR): Error while processing System request	INFO	BEFORE_REQUEST

Re: Status Field Showing Both the values in same field?

ITWhisperer — Thu, 09 May 2024 22:01:54 GMT

So if a transaction has both ERROR and not ERROR, what do you want it to show?

Re: Status Field Showing Both the values in same field?

karthi2809 — Fri, 10 May 2024 02:00:25 GMT

If error and exception then it should be error rest of them are success.but using the below query to get status still.i got both suuccess and error for the some of the transactions ID

| eval Status=case(priority="ERROR" AND tracePoint="EXCEPTION" OR message="*Error while processing*","ERROR", priority="WARN","WARN",priority!="ERROR" AND tracePoint!="EXCEPTION" OR message!="*(ERROR):*","SUCCESS") |stats values(Status) as Status by transactionId

Re: Status Field Showing Both the values in same field?

ITWhisperer — Fri, 10 May 2024 08:06:31 GMT