topic Re: Can I get search script to filter only errpt errors? in Splunk Search https://community.splunk.com/t5/Splunk-Search/Can-I-get-search-script-to-filter-only-errpt-errors/m-p/128479#M34881 <P>its issue with your logging of syslog as its getting re-indexed. You can check inputs and get that fixed though if you want to continue as it is and remove duplicates use : source="/var/adm/syslog/syslog.log" ERRLOGGER | dedup _raw</P> Sun, 28 Feb 2016 18:09:29 GMT anilyelmar 2016-02-28T18:09:29Z Can I get search script to filter only errpt errors? https://community.splunk.com/t5/Splunk-Search/Can-I-get-search-script-to-filter-only-errpt-errors/m-p/128475#M34877 <P>I am getting below output when i am searching in syslog. I want to filter only Error Log messages given below.</P> <P>search :source="/var/adm/syslog/syslog.log" | multikv |</P> <PRE><CODE>Time Event 2/5/15 4:09:15.000 PM Feb 5 16:09:15 bhx26 user:notice root: Msg from Error Log: --------------------------------------------------------------------------- LABEL: OPMSG IDENTIFIER: AA8AB241 Date/Time: Thu Feb 5 16:09:15 EST 2015 Sequence Number: 387 Machine Id: 00C463C74C00 Node Id: bhx26 Class: O Type: TEMP WPAR: Global Resource Name: OPERATOR Description OPERATOR NOTIFICATION User Causes ERRLOGGER COMMAND Recommended Actions REVIEW DETAILED DATA Detail Data MESSAGE FROM ERRLOGGER COMMAND this is a test host = Host name source = /var/adm/syslog/syslog.log sourcetype = syslog-2 2/5/15 4:09:15.000 PM Feb 5 16:09:15 bhx26 user:notice root: Msg from Error Log: --------------------------------------------------------------------------- LABEL: OPMSG IDENTIFIER: AA8AB241 Date/Time: Thu Feb 5 16:09:15 EST 2015 Sequence Number: 387 Machine Id: 00C463C74C00 Node Id: bhx26 Class: O Type: TEMP WPAR: Global Resource Name: OPERATOR Description OPERATOR NOTIFICATION User Causes ERRLOGGER COMMAND Recommended Actions REVIEW DETAILED DATA Detail Data MESSAGE FROM ERRLOGGER COMMAND this is a test host = Host name source = /var/adm/syslog/syslog.log sourcetype = syslog-2 2/5/15 4:09:03.000 PM Feb 5 16:09:03 bhx26 auth|security:debug sshd[14155806]: debug3: fd 8 is O_NONBLOCK host = Host name source = /var/adm/syslog/syslog.log sourcetype = syslog-2 2/5/15 4:09:03.000 PM Feb 5 16:09:03 bhx26 auth|security:debug sshd[14155806]: debug2: fd 11 setting O_NONBLOCK host = Host name source = /var/adm/syslog/syslog.log sourcetype = syslog-2 2/5/15 4:09:03.000 PM Feb 5 16:09:03 bhx26 auth|security:debug sshd[14155806]: debug2: channel 0: rfd 11 isatty </CODE></PRE> Thu, 05 Feb 2015 21:30:40 GMT https://community.splunk.com/t5/Splunk-Search/Can-I-get-search-script-to-filter-only-errpt-errors/m-p/128475#M34877 gsrikanth87 2015-02-05T21:30:40Z Re: Can I get search script to filter only errpt errors? https://community.splunk.com/t5/Splunk-Search/Can-I-get-search-script-to-filter-only-errpt-errors/m-p/128476#M34878 <P>Can you provide a mockup of what you would like to see?</P> Fri, 06 Feb 2015 01:48:54 GMT https://community.splunk.com/t5/Splunk-Search/Can-I-get-search-script-to-filter-only-errpt-errors/m-p/128476#M34878 David 2015-02-06T01:48:54Z Re: Can I get search script to filter only errpt errors? https://community.splunk.com/t5/Splunk-Search/Can-I-get-search-script-to-filter-only-errpt-errors/m-p/128477#M34879 <P>I think this will be a good start</P> <PRE><CODE>source="/var/adm/syslog/syslog.log" ERRLOGGER </CODE></PRE> Fri, 06 Feb 2015 06:42:02 GMT https://community.splunk.com/t5/Splunk-Search/Can-I-get-search-script-to-filter-only-errpt-errors/m-p/128477#M34879 lguinn2 2015-02-06T06:42:02Z Re: Can I get search script to filter only errpt errors? https://community.splunk.com/t5/Splunk-Search/Can-I-get-search-script-to-filter-only-errpt-errors/m-p/128478#M34880 <P>Yes, but I am getting 2 duplicate results for each error, </P> <P>Time Event<BR /> 2/5/15 <BR /> 4:09:15.000 PM<BR /><BR /> Feb 5 16:09:15 bhx26 user:notice root: Msg from Error Log: --------------------------------------------------------------------------- LABEL: OPMSG IDENTIFIER: AA8AB241 Date/Time: Thu Feb 5 16:09:15 EST 2015 Sequence Number: 387 Machine Id: 00C463C74C00 Node Id: bhx26 Class: O Type: TEMP WPAR: Global Resource Name: OPERATOR Description OPERATOR NOTIFICATION User Causes ERRLOGGER COMMAND Recommended Actions REVIEW DETAILED DATA Detail Data MESSAGE FROM ERRLOGGER COMMAND this is a test <BR /> host = Host name source = /var/adm/syslog/syslog.log sourcetype = syslog-2</P> <P>2/5/15 <BR /> 4:09:15.000 PM<BR /><BR /> Feb 5 16:09:15 bhx26 user:notice root: Msg from Error Log: --------------------------------------------------------------------------- LABEL: OPMSG IDENTIFIER: AA8AB241 Date/Time: Thu Feb 5 16:09:15 EST 2015 Sequence Number: 387 Machine Id: 00C463C74C00 Node Id: bhx26 Class: O Type: TEMP WPAR: Global Resource Name: OPERATOR Description OPERATOR NOTIFICATION User Causes ERRLOGGER COMMAND Recommended Actions REVIEW DETAILED DATA Detail Data MESSAGE FROM ERRLOGGER COMMAND this is a test <BR /> host = Host name source = /var/adm/syslog/syslog.log sourcetype = syslog-2</P> Fri, 06 Feb 2015 14:58:56 GMT https://community.splunk.com/t5/Splunk-Search/Can-I-get-search-script-to-filter-only-errpt-errors/m-p/128478#M34880 gsrikanth87 2015-02-06T14:58:56Z Re: Can I get search script to filter only errpt errors? https://community.splunk.com/t5/Splunk-Search/Can-I-get-search-script-to-filter-only-errpt-errors/m-p/128479#M34881 <P>its issue with your logging of syslog as its getting re-indexed. You can check inputs and get that fixed though if you want to continue as it is and remove duplicates use : source="/var/adm/syslog/syslog.log" ERRLOGGER | dedup _raw</P> Sun, 28 Feb 2016 18:09:29 GMT https://community.splunk.com/t5/Splunk-Search/Can-I-get-search-script-to-filter-only-errpt-errors/m-p/128479#M34881 anilyelmar 2016-02-28T18:09:29Z