Splunk Cloud Platform

Search string and evaluate the string

agamnarendra
Explorer

I need to findout errorcodes from logs and segregate them. Below log file is one of example logs.

 

2021-06-08T05:42:29.141140+00:00 DEBUG html5client-v3[19206]: [xid@1192 xid=S2TF6U5T--7 cid=Arris-110_20F19EB3C050 did= sid=5kCrKTc-K-4 hid="19206"] CONSOLE:0 (null) - 06-08-2021 05:42:29.141 DEBUG (SGUI.VENONA_ANALYTICS){"action":"error","data":{"category":"error","triggeredBy":"application","errorCode":"GEN-1016","errorType":"application","errorMessage":"We're sorry, we're unable to load your subscription info. Please try again later. \nReference Code:  GEN-1016","success":false,

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| rex "\"errorCode\":\"(?<errorCode>[^\"]+)"

View solution in original post

agamnarendra
Explorer

index=platform sourcetype=cloudtvapp NOT (host="*dev*")
| rex "\"errorCode\":\"(?<errorCode>[^\"]+)"
| table errorCode cid

Thank you for quick response @ITWhisperer 

Its not printing the errorCode with respective cid value. Search and filter is happened but not printed with above search. Any inputs?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Is cid being extracted automatically or do you need to extract as part of your search?

0 Karma

agamnarendra
Explorer

Below search was helped to get the desired out put. but need to errorType filter in "rex". Can you guide me

index=platform sourcetype=cloudtvapp NOT (host="*dev*" OR host="*zod*")
| rex "\"errorCode\":\"(?<errorCode>[^\"]+)"
| search errorCode="*"
| stats count(errorCode) by errorCode host

 

cid was added automatically . But need to "errorType" and "errorMessage" with respective  filter in "rex". Can you guide me

Basically i need to add more than one field search in "rex"

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index=platform sourcetype=cloudtvapp NOT (host="*dev*" OR host="*zod*")
| rex "\"errorCode\":\"(?<errorCode>[^\"]+)\",\"errorType\":\"(?<errorType>[^\"]+)\",\"errorMessage\":\"(?<errorMessage>[^\"]+)"
| search errorCode="*"
| stats count values(errorType) as errorType values(errorMessage) as errorMessage by errorCode host

agamnarendra
Explorer

Thank you a lot

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex "\"errorCode\":\"(?<errorCode>[^\"]+)"
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...