Getting Data In
Highlighted

How do I group unstructured events based on errorcode that they contain in body?

Engager

I have some base splunk query which gives me list of events which has body mentioned below -

event 1.

{"Errors":{"Error":{"RequestId":"112314082","Source":"","ReasonCode":"MISSINGREQUIREDINPUT","Description":"Missing Required Input","Recoverable":"false","Details":{"Detail":{"Name":"ErrorDetailCode","Value":"092000"}}}}}

event 2.

{"Errors":{"Error":{"RequestId":"112314082","Source":"","ReasonCode":"MISSINGREQUIREDINPUT","Description":"Missing Required Input","Recoverable":"false","Details":{"Detail":{"Name":"ErrorDetailCode","Value":"092001"}}}}}

event 3.

{"Errors":{"Error":{"RequestId":"112314082","Source":"","ReasonCode":"MISSINGREQUIREDINPUT","Description":"Missing Required Input","Recoverable":"false","Details":{"Detail":{"Name":"ErrorDetailCode","Value":"092000"}}}}}

event 4.
{"Errors":{"Error":{"RequestId":"112314082","Source":"","ReasonCode":"MISSINGREQUIREDINPUT","Description":"Missing Required Input","Recoverable":"false","Details":{"Detail":{"Name":"ErrorDetailCode","Value":"092002"}}}}}

I need to group these events based on message body's ErrorDetailCode value.
e.g.
ErrorCode Count

092000 - 2
092001 - 1
092002 - 1

Can someone please help me or guide me to build as I am new to Splunk ?

0 Karma
Highlighted

Re: How do I group unstructured events based on errorcode that they contain in body?

Ultra Champion

Hi @dhirajnangar try:

...your serach|rex field=_raw "ErrorDetailCode.+Value\":\"(?P<errorCode>\d+)" |stats count by errorCode

0 Karma
Highlighted

Re: How do I group unstructured events based on errorcode that they contain in body?

Ultra Champion
| makeresults
| eval _raw="{\"Errors\":{\"Error\":{\"RequestId\":\"112314082\",\"Source\":\"\",\"ReasonCode\":\"MISSING_REQUIRED_INPUT\",\"Description\":\"Missing Required Input\",\"Recoverable\":\"false\",\"Details\":{\"Detail\":{\"Name\":\"ErrorDetailCode\",\"Value\":\"092000\"}}}}}
{\"Errors\":{\"Error\":{\"RequestId\":\"112314082\",\"Source\":\"\",\"ReasonCode\":\"MISSING_REQUIRED_INPUT\",\"Description\":\"Missing Required Input\",\"Recoverable\":\"false\",\"Details\":{\"Detail\":{\"Name\":\"ErrorDetailCode\",\"Value\":\"092001\"}}}}}
{\"Errors\":{\"Error\":{\"RequestId\":\"112314082\",\"Source\":\"\",\"ReasonCode\":\"MISSING_REQUIRED_INPUT\",\"Description\":\"Missing Required Input\",\"Recoverable\":\"false\",\"Details\":{\"Detail\":{\"Name\":\"ErrorDetailCode\",\"Value\":\"092000\"}}}}}
{\"Errors\":{\"Error\":{\"RequestId\":\"112314082\",\"Source\":\"\",\"ReasonCode\":\"MISSING_REQUIRED_INPUT\",\"Description\":\"Missing Required Input\",\"Recoverable\":\"false\",\"Details\":{\"Detail\":{\"Name\":\"ErrorDetailCode\",\"Value\":\"092002\"}}}}}"
| eval raw=split(_raw,"
")
| mvexpand raw
| rename raw as _raw
`comment("this is your sample")`
`comment("From here, the logic")`
| spath path=Errors.Error.Details.Detail.Value output=ErrorCode
| stats count by ErrorCode

Hi, how about this?

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.