Splunk Search

Can someone explain why I'm getting this confusing search output?

Navitas28
New Member

Hi

sourcetype="SourceA" ERROR NOT "GET-INFO" NOT "GET-ArchivedInfo" NOT "Error1" NOT "ERROR2" 

The above search gives 0 results found meaning there are two types of error

Now, when creating a report like :

sourcetype="SourceA" ERROR NOT "GET-INFO" NOT "GET-ArchivedInfo" 
| eval errorMessage = "Others"
| append[search sourcetype="SourceA" ERROR NOT "GET-INFO" NOT "GET-ArchivedInfo" "Error1"]
                 | eval errorMessage = "Error1"
| append[search sourcetype="SourceA" ERROR NOT "GET-INFO" NOT "GET-ArchivedInfo" "Error2"]
                 | eval errorMessage = "Error2"

The above search results are showing so many errorMessage as "Others"

Can someone please help me in understanding what I am doing wrong ?

0 Karma
1 Solution

DalJeanis
Legend

Your code you showed us CANNOT EVER get a result of "Other" because the last eval will set every record to "Error2", regardless of what kind of record it is.

Try something like this and see what you get.

sourcetype="SourceA" ERROR NOT "GET-INFO" NOT "GET-ArchivedInfo" 
| eval ErrType=case(match(_raw,"Error 1 Message string"),"Error1",
     match(_raw,"Error 2 message"),"Error1",
    true(),"Other")

FIll in the "Error 1 Message String" with a string that will match only that kind of record. Remember to escape any periods or asterisks... in this case you can probably get away with just putting each one in square braces.... like [.] or [*]. If you can't figure out how to make the match logic work, then get on the splunk slack channel, #regex subchannel, and we can help you get it right.

View solution in original post

0 Karma

DalJeanis
Legend

Your code you showed us CANNOT EVER get a result of "Other" because the last eval will set every record to "Error2", regardless of what kind of record it is.

Try something like this and see what you get.

sourcetype="SourceA" ERROR NOT "GET-INFO" NOT "GET-ArchivedInfo" 
| eval ErrType=case(match(_raw,"Error 1 Message string"),"Error1",
     match(_raw,"Error 2 message"),"Error1",
    true(),"Other")

FIll in the "Error 1 Message String" with a string that will match only that kind of record. Remember to escape any periods or asterisks... in this case you can probably get away with just putting each one in square braces.... like [.] or [*]. If you can't figure out how to make the match logic work, then get on the splunk slack channel, #regex subchannel, and we can help you get it right.

0 Karma
Get Updates on the Splunk Community!

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...