Getting Data In

How do I group unstructured events based on errorcode that they contain in body?

dhirajnangar
Engager

I have some base splunk query which gives me list of events which has body mentioned below -

event 1.

{"Errors":{"Error":{"RequestId":"112314082","Source":"","ReasonCode":"MISSING_REQUIRED_INPUT","Description":"Missing Required Input","Recoverable":"false","Details":{"Detail":{"Name":"ErrorDetailCode","Value":"092000"}}}}}

event 2.

{"Errors":{"Error":{"RequestId":"112314082","Source":"","ReasonCode":"MISSING_REQUIRED_INPUT","Description":"Missing Required Input","Recoverable":"false","Details":{"Detail":{"Name":"ErrorDetailCode","Value":"092001"}}}}}

event 3.

{"Errors":{"Error":{"RequestId":"112314082","Source":"","ReasonCode":"MISSING_REQUIRED_INPUT","Description":"Missing Required Input","Recoverable":"false","Details":{"Detail":{"Name":"ErrorDetailCode","Value":"092000"}}}}}

event 4.
{"Errors":{"Error":{"RequestId":"112314082","Source":"","ReasonCode":"MISSING_REQUIRED_INPUT","Description":"Missing Required Input","Recoverable":"false","Details":{"Detail":{"Name":"ErrorDetailCode","Value":"092002"}}}}}

I need to group these events based on message body's ErrorDetailCode value.
e.g.
ErrorCode Count

092000 - 2
092001 - 1
092002 - 1

Can someone please help me or guide me to build as I am new to Splunk ?

0 Karma

to4kawa
Ultra Champion
| makeresults
| eval _raw="{\"Errors\":{\"Error\":{\"RequestId\":\"112314082\",\"Source\":\"\",\"ReasonCode\":\"MISSING_REQUIRED_INPUT\",\"Description\":\"Missing Required Input\",\"Recoverable\":\"false\",\"Details\":{\"Detail\":{\"Name\":\"ErrorDetailCode\",\"Value\":\"092000\"}}}}}
{\"Errors\":{\"Error\":{\"RequestId\":\"112314082\",\"Source\":\"\",\"ReasonCode\":\"MISSING_REQUIRED_INPUT\",\"Description\":\"Missing Required Input\",\"Recoverable\":\"false\",\"Details\":{\"Detail\":{\"Name\":\"ErrorDetailCode\",\"Value\":\"092001\"}}}}}
{\"Errors\":{\"Error\":{\"RequestId\":\"112314082\",\"Source\":\"\",\"ReasonCode\":\"MISSING_REQUIRED_INPUT\",\"Description\":\"Missing Required Input\",\"Recoverable\":\"false\",\"Details\":{\"Detail\":{\"Name\":\"ErrorDetailCode\",\"Value\":\"092000\"}}}}}
{\"Errors\":{\"Error\":{\"RequestId\":\"112314082\",\"Source\":\"\",\"ReasonCode\":\"MISSING_REQUIRED_INPUT\",\"Description\":\"Missing Required Input\",\"Recoverable\":\"false\",\"Details\":{\"Detail\":{\"Name\":\"ErrorDetailCode\",\"Value\":\"092002\"}}}}}"
| eval raw=split(_raw,"
")
| mvexpand raw
| rename raw as _raw
`comment("this is your sample")`
`comment("From here, the logic")`
| spath path=Errors.Error.Details.Detail.Value output=ErrorCode
| stats count by ErrorCode

Hi, how about this?

0 Karma

nickhills
Ultra Champion

Hi @dhirajnangar try:

...your serach|rex field=_raw "ErrorDetailCode.+Value\":\"(?P<errorCode>\d+)" |stats count by errorCode

If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...