Dashboards & Visualizations

Creating a table, but it shows 3 column error msg?

Khanu89
Path Finder

I am trying to create a table which shows 3 column error msg, errorcode, and count. my current query is pulling the errorcode/msg in one column and error count  individually instead of whole. Please assist.

my Current Query

My current queryMy current query

 

 

 

 

 

Current Output

Screen Shot 2022-05-09 at 8.46.04 PM.png

Expected Output

Screen Shot 2022-05-09 at 8.52.59 PM.png

Labels (3)
0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@Khanu89 - It's actually an issue with regex (rex) extracting ErrorCode, that it is extracting ErrorCode and error message everything in a single field.

You can try extracting them separately and then you can update your stats to add the error_msg field in the groupby (or by).

 

I hope this helps!!!

 

Khanu89
Path Finder

@VatsalJagani  Thank you for your input. Can you please elaborate on how can I extract separately?

Tags (1)
0 Karma

VatsalJagani
SplunkTrust
SplunkTrust
| rex field=_raw "%\s(?<ErrorCode>\d+)\s(?<error_msg>.*)\s"

 

And then you can use 

| stats ..... by ErrorCode, error_msg

 

something like this. Regex could not be valid for all the use cases, I'm just seeing a few examples from the screenshot.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...