Dashboards & Visualizations

How to not include LD_PRELOAD in Error Alerts?

aditsss
Motivator

Hi All,

I have created Alerts on the basis of Error keyword . Below is one of my alert

index=abc ns=blazegateway-c2 CASE(ERROR) NOT "INTERNAL_SERVER_ERROR"|rex field=_raw "(?<!LogLevel=)ERROR(?<Error_Message>.*)"|eval _time = strftime(_time,"%Y-%m-%d %H:%M:%S.%3N")| cluster showcount=t t=0.4|table app_name, Error_Message ,cluster_count,_time, environment, pod_name,ns |dedup Error_Message| rename app_name as APP_NAME, _time as Time, environment as Environment, pod_name as Pod_Name, cluster_count as Count

On the basis of above query I am getting one of the Error message as shown below:

message = ERROR: ld.so: object 'libnss_wrapper.so' from LD_PRELOAD cannot be preloaded: ignored.

I want Error message with LD_PRELOAD should not come in Alerts.

Can someone guide me what should I change in my alerts

 

 

 

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Just like you have an exclusion for "INTERNAL_SERVER_ERROR", add a similar exclusion for "LD_PRELOAD".

index=abc ns=blazegateway-c2 CASE(ERROR) NOT "INTERNAL_SERVER_ERROR" NOT "LD_PRELOAD"
| rex field=_raw "(?<!LogLevel=)ERROR(?<Error_Message>.*)"
| eval _time = strftime(_time,"%Y-%m-%d %H:%M:%S.%3N")
| cluster showcount=t t=0.4
| table app_name, Error_Message ,cluster_count,_time, environment, pod_name,ns | dedup Error_Message
| rename app_name as APP_NAME, _time as Time, environment as Environment, pod_name as Pod_Name, cluster_count as Count
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Just like you have an exclusion for "INTERNAL_SERVER_ERROR", add a similar exclusion for "LD_PRELOAD".

index=abc ns=blazegateway-c2 CASE(ERROR) NOT "INTERNAL_SERVER_ERROR" NOT "LD_PRELOAD"
| rex field=_raw "(?<!LogLevel=)ERROR(?<Error_Message>.*)"
| eval _time = strftime(_time,"%Y-%m-%d %H:%M:%S.%3N")
| cluster showcount=t t=0.4
| table app_name, Error_Message ,cluster_count,_time, environment, pod_name,ns | dedup Error_Message
| rename app_name as APP_NAME, _time as Time, environment as Environment, pod_name as Pod_Name, cluster_count as Count
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...