https://community.splunk.com/t5/Splunk-Search/How-to-create-a-dashboard-search-with-the-condition-quot-If/m-p/257917#M77251 <P>I want to create a dashboard with a table listing integration name and execution status with the following condition:</P> <P>If execution status is different than success -&gt; on same row, show error code, error type, and error message</P> Mon, 17 Oct 2016 19:51:28 GMT splgeek 2016-10-17T19:51:28Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-dashboard-search-with-the-condition-quot-If/m-p/257917#M77251 <P>I want to create a dashboard with a table listing integration name and execution status with the following condition:</P> <P>If execution status is different than success -&gt; on same row, show error code, error type, and error message</P> Mon, 17 Oct 2016 19:51:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-dashboard-search-with-the-condition-quot-If/m-p/257917#M77251 splgeek 2016-10-17T19:51:28Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-dashboard-search-with-the-condition-quot-If/m-p/257918#M77252 <P>Assuming the fields integrationName, executionStatus (success/failure), errorCode, errorType and errorMessage are already extracted use below</P> <PRE><CODE>yourQuery to return all the fields | table integrationName, executionStatus, errorCode, errorType and errorMessage | where executionStatus!="success" </CODE></PRE> Mon, 17 Oct 2016 19:55:59 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-dashboard-search-with-the-condition-quot-If/m-p/257918#M77252 gokadroid 2016-10-17T19:55:59Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-dashboard-search-with-the-condition-quot-If/m-p/257919#M77253 <PRE><CODE>index=ko_mulesoft source="*" source="*" "LOG.Execution.Status"="*" | table source, LOG.Execution.Status </CODE></PRE> <P>Above search got me 278 3 results.</P> <P>Next part to achieve is<BR /> <EM>if execution status is different than success -&gt; on same row, show error code, error type and error message</EM></P> <P>How do I achieve that?</P> Mon, 17 Oct 2016 20:10:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-dashboard-search-with-the-condition-quot-If/m-p/257919#M77253 splgeek 2016-10-17T20:10:00Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-dashboard-search-with-the-condition-quot-If/m-p/257920#M77254 <P>Looks like the "LOG.Execution.Status" is part of your data as a string and not as a field. You need to first extract the fields from your data strings</P> <P>How to extract fields, see here:<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.5.0/Knowledge/ExtractfieldsinteractivelywithIFX">http://docs.splunk.com/Documentation/Splunk/6.5.0/Knowledge/ExtractfieldsinteractivelywithIFX</A><BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.5.0/Knowledge/Managesearch-timefieldextractions">http://docs.splunk.com/Documentation/Splunk/6.5.0/Knowledge/Managesearch-timefieldextractions</A></P> <P>Once the fields are extracted then you should run the query I put in where each of these is a Field in which your event data is saved as a result.</P> <P>integrationName, executionStatus, errorCode, errorType and errorMessage </P> <P>Else if you can paste your mulesoft log line here which has all the required data which you want to extract info from so I can assist you with the fields extraction.</P> Mon, 17 Oct 2016 20:45:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-dashboard-search-with-the-condition-quot-If/m-p/257920#M77254 gokadroid 2016-10-17T20:45:29Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-dashboard-search-with-the-condition-quot-If/m-p/257921#M77255 <P>I extracted Log.Execution.Status as a field , and now its pulls up all the status</P> <P>How do i add another row in the table for this logic</P> <P>If execution status is different than success -&gt; on same row, show error code, error type, and error message</P> Tue, 18 Oct 2016 13:52:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-dashboard-search-with-the-condition-quot-If/m-p/257921#M77255 splgeek 2016-10-18T13:52:20Z