Archive
Highlighted

Can someone explain why I'm getting this confusing search output?

New Member

Hi

sourcetype="SourceA" ERROR NOT "GET-INFO" NOT "GET-ArchivedInfo" NOT "Error1" NOT "ERROR2" 

The above search gives 0 results found meaning there are two types of error

Now, when creating a report like :

sourcetype="SourceA" ERROR NOT "GET-INFO" NOT "GET-ArchivedInfo" 
| eval errorMessage = "Others"
| append[search sourcetype="SourceA" ERROR NOT "GET-INFO" NOT "GET-ArchivedInfo" "Error1"]
                 | eval errorMessage = "Error1"
| append[search sourcetype="SourceA" ERROR NOT "GET-INFO" NOT "GET-ArchivedInfo" "Error2"]
                 | eval errorMessage = "Error2"

The above search results are showing so many errorMessage as "Others"

Can someone please help me in understanding what I am doing wrong ?

0 Karma
Highlighted

Re: Can someone explain why I'm getting this confusing search output?

SplunkTrust
SplunkTrust

Your code you showed us CANNOT EVER get a result of "Other" because the last eval will set every record to "Error2", regardless of what kind of record it is.

Try something like this and see what you get.

sourcetype="SourceA" ERROR NOT "GET-INFO" NOT "GET-ArchivedInfo" 
| eval ErrType=case(match(_raw,"Error 1 Message string"),"Error1",
     match(_raw,"Error 2 message"),"Error1",
    true(),"Other")

FIll in the "Error 1 Message String" with a string that will match only that kind of record. Remember to escape any periods or asterisks... in this case you can probably get away with just putting each one in square braces.... like [.] or [*]. If you can't figure out how to make the match logic work, then get on the splunk slack channel, #regex subchannel, and we can help you get it right.

View solution in original post

0 Karma