Splunk Search

Can someone explain why I'm getting this confusing search output?

Navitas28
New Member

Hi

sourcetype="SourceA" ERROR NOT "GET-INFO" NOT "GET-ArchivedInfo" NOT "Error1" NOT "ERROR2" 

The above search gives 0 results found meaning there are two types of error

Now, when creating a report like :

sourcetype="SourceA" ERROR NOT "GET-INFO" NOT "GET-ArchivedInfo" 
| eval errorMessage = "Others"
| append[search sourcetype="SourceA" ERROR NOT "GET-INFO" NOT "GET-ArchivedInfo" "Error1"]
                 | eval errorMessage = "Error1"
| append[search sourcetype="SourceA" ERROR NOT "GET-INFO" NOT "GET-ArchivedInfo" "Error2"]
                 | eval errorMessage = "Error2"

The above search results are showing so many errorMessage as "Others"

Can someone please help me in understanding what I am doing wrong ?

0 Karma
1 Solution

DalJeanis
SplunkTrust
SplunkTrust

Your code you showed us CANNOT EVER get a result of "Other" because the last eval will set every record to "Error2", regardless of what kind of record it is.

Try something like this and see what you get.

sourcetype="SourceA" ERROR NOT "GET-INFO" NOT "GET-ArchivedInfo" 
| eval ErrType=case(match(_raw,"Error 1 Message string"),"Error1",
     match(_raw,"Error 2 message"),"Error1",
    true(),"Other")

FIll in the "Error 1 Message String" with a string that will match only that kind of record. Remember to escape any periods or asterisks... in this case you can probably get away with just putting each one in square braces.... like [.] or [*]. If you can't figure out how to make the match logic work, then get on the splunk slack channel, #regex subchannel, and we can help you get it right.

View solution in original post

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Your code you showed us CANNOT EVER get a result of "Other" because the last eval will set every record to "Error2", regardless of what kind of record it is.

Try something like this and see what you get.

sourcetype="SourceA" ERROR NOT "GET-INFO" NOT "GET-ArchivedInfo" 
| eval ErrType=case(match(_raw,"Error 1 Message string"),"Error1",
     match(_raw,"Error 2 message"),"Error1",
    true(),"Other")

FIll in the "Error 1 Message String" with a string that will match only that kind of record. Remember to escape any periods or asterisks... in this case you can probably get away with just putting each one in square braces.... like [.] or [*]. If you can't figure out how to make the match logic work, then get on the splunk slack channel, #regex subchannel, and we can help you get it right.

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...