Dashboards & Visualizations

How to create alert of errors that does not include INTERNAL_SERVER_ERROR?

aditsss
Motivator

Hi All

I have created below alert to capture the ERROR LOGS

index=abc ns=blazegateway ERROR |rex field=_raw "(?<!LogLevel=)ERROR(?<Error_Message>.*)" |eval _time = strftime(_time,"%Y-%m-%d %H:%M:%S.%3N")|cluster showcount=t t=0.4|table app_name, Error_Message ,cluster_count,_time, env, pod_name,ns|dedup Error_Message | rename app_name as APP_NAME, _time as Time, env as Environment, pod_name as Pod_Name, Error_Message as Error_Message,cluster_count as Count

I am capturing on the basis of Keyword ERROR

But I don't want INTERNAL SERVER TO captured in it. Currently it is capturing INTERNAL_SERVER_ERROR as well as I am fetching on the basis of ERROR keyword

routeId:dmr_file_upload,destinationServiceURL:operation:dmruploadserviceResponseStatus=FailurerouteResponseHttpStatusCode=500 INTERNAL_SERVER_ERRORserviceResponseTime(ms)=253

Can someone guide me how to exclude INTERNAL_SERVER_ERROR from my alerts

 

Labels (3)
0 Karma
1 Solution

rrovers
Communicator

add 

NOT "INTERNAL_SERVER_ERROR" 

so:

index=abc ns=blazegateway ERROR NOT "INTERNAL_SERVER_ERROR"

 

View solution in original post

rrovers
Communicator

add 

NOT "INTERNAL_SERVER_ERROR" 

so:

index=abc ns=blazegateway ERROR NOT "INTERNAL_SERVER_ERROR"

 

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...