Can someone explain why I'm getting this confusing search output?

[Navitas28]

Hi

sourcetype="SourceA" ERROR NOT "GET-INFO" NOT "GET-ArchivedInfo" NOT "Error1" NOT "ERROR2" 

The above search gives 0 results found meaning there are two types of error

Now, when creating a report like :

sourcetype="SourceA" ERROR NOT "GET-INFO" NOT "GET-ArchivedInfo" 
| eval errorMessage = "Others"
| append[search sourcetype="SourceA" ERROR NOT "GET-INFO" NOT "GET-ArchivedInfo" "Error1"]
                 | eval errorMessage = "Error1"
| append[search sourcetype="SourceA" ERROR NOT "GET-INFO" NOT "GET-ArchivedInfo" "Error2"]
                 | eval errorMessage = "Error2"

The above search results are showing so many errorMessage as "Others"

Can someone please help me in understanding what I am doing wrong ?

[DalJeanis · Accepted solution]

Your code you showed us CANNOT EVER get a result of "Other" because the last eval will set every record to "Error2", regardless of what kind of record it is.

Try something like this and see what you get.

sourcetype="SourceA" ERROR NOT "GET-INFO" NOT "GET-ArchivedInfo" 
| eval ErrType=case(match(_raw,"Error 1 Message string"),"Error1",
     match(_raw,"Error 2 message"),"Error1",
    true(),"Other")

FIll in the "Error 1 Message String" with a string that will match only that kind of record. Remember to escape any periods or asterisks... in this case you can probably get away with just putting each one in square braces.... like [.] or [*]. If you can't figure out how to make the match logic work, then get on the splunk slack channel, #regex subchannel, and we can help you get it right.