- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- Dashboard creation
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Dashboard creation
Hi
I have a xml response in splunk whenever i query a index.I used to get the error msg in
</soap:Envelope>", RESPONSE="<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"> <soapenv:Header/> <soapenv:Body> <soapenv:Fault xmlns:trefault="http://tresoap.intecbilling.com/fault/2.0"> <faultcode>trefault:ApplicationException</faultcode> <faultstring><CM-41398> ERROR: Value "Apple Watch 4G 5GB" supplied for Fact "OrderedComp.RatePlan_R" is not allowed by the fact's filter search or expression</faultstring> <detail> <trefault:Detail> <trefault:Message><CM-41398> ERROR: Value "Apple Watch 4G 5GB" supplied for Fact "OrderedComp.RatePlan_R" is not allowed by the fact's filter search or expression</trefault:Message> <trefault:ErrorId>41398</trefault:ErrorId> </trefault:Detail> </detail> </soapenv:Fault> </soapenv:Body>
Can someone tell me how to extract this error msg from the xml and display the error msg in a seperate panel as table in dashboard
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
when i run the above query, am getting "invalid arguement near innisbrook"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Weird typo is fixed.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
i want the error messgae from "faultstring" to be displayed in my results:
</soap:Envelope>", RESPONSE="<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"> <soap:Header></soap:Header> <soap:Body> <soap:Fault> <faultcode>soap:Server</faultcode> <faultstring>APPL0014: IO Exception: Read timed out java.net.SocketTimeoutException: Read timed out</faultstring> </soap:Fault> </soap:Body>
My splunk query is below:
index="abc" source="xyz" OPERATION = "getOrderService"
|rex "RESPONSE=\\\"(?<RESPONSE>.+)"
|spath input=RESPONSE
|spath input=RESPONSE output=faultstring path=soapenv:Envelope.soap:Header.soapenv:Body.soapenv:Fault.faultcode.faultstring
instead of fetching only one response with faultstring, its fetching all the results from the responses
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That's what Splunk does - it fetches all of the events that meet the search criteria. If you want a single response then put that in the SPL using head 1, tail 1, dedup or something similar.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
but then also its fetching all the responses from the results instead of faultstring only it s not filtering out the responses based on that tag
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Use the spath command to parse the XML then select the desired field. If spath doesn't work, it's because the XML is not valid. You may need to strip out excess quotes.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
if i give the below query to extract the error msg alone from the soap response:
index="abcl" sourcetype="oracle:transactionlog" OPERATION = "getOrderService"
|rex "REQUEST=\"(?<REQUEST>.+)\", RESPONSE=\"(?<RESPONSE>.+)\", RETRYNO"
|spath input=RESPONSE
|spath input=RESPONE output=trefault:Message path=trefault:Message
am getting no response
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
There are no results because the rex command is not extracting any fields. That's because it is looking for text ("REQUEST" and "RETRYNO") that don't exist (at least not in the sample event). This run-anywhere query works for me.
| makeresults
| eval _raw="</soap:Envelope>\", RESPONSE=\"<soapenv:Envelope xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\"> <soapenv:Header/> <soapenv:Body> <soapenv:Fault xmlns:trefault=\"http://tresoap.intecbilling.com/fault/2.0\"> <faultcode>trefault:ApplicationException</faultcode> <faultstring><CM-41398> ERROR: Value "Apple Watch 4G 5GB" supplied for Fact "OrderedComp.RatePlan_R" is not allowed by the fact's filter search or expression</faultstring> <detail> <trefault:Detail> <trefault:Message><CM-41398> ERROR: Value "Apple Watch 4G 5GB" supplied for Fact "OrderedComp.RatePlan_R" is not allowed by the fact's filter search or expression</trefault:Message> <trefault:ErrorId>41398</trefault:ErrorId> </trefault:Detail> </detail> </soapenv:Fault> </soapenv:Body>"
|rex "RESPONSE=\\\"(?<RESPONSE>.+)"
|spath input=RESPONSE
|spath input=RESPONSE output=trefault:Message path=soapenv:Envelope.soapenv:Body.soapenv:Fault.faultstring.detail.trefault:Detail.trefault:Message
If this reply helps you, Karma would be appreciated.
Splunk Smartness with Brandon Sternfield | Episode 3
Monitoring Postgres with OpenTelemetry
Mastering Synthetic Browser Testing: Pro Tips to Keep Your Web App Running Smoothly
