Splunk Search

Can someone explain why I'm getting this confusing search output?

Navitas28
New Member

Hi

sourcetype="SourceA" ERROR NOT "GET-INFO" NOT "GET-ArchivedInfo" NOT "Error1" NOT "ERROR2" 

The above search gives 0 results found meaning there are two types of error

Now, when creating a report like :

sourcetype="SourceA" ERROR NOT "GET-INFO" NOT "GET-ArchivedInfo" 
| eval errorMessage = "Others"
| append[search sourcetype="SourceA" ERROR NOT "GET-INFO" NOT "GET-ArchivedInfo" "Error1"]
                 | eval errorMessage = "Error1"
| append[search sourcetype="SourceA" ERROR NOT "GET-INFO" NOT "GET-ArchivedInfo" "Error2"]
                 | eval errorMessage = "Error2"

The above search results are showing so many errorMessage as "Others"

Can someone please help me in understanding what I am doing wrong ?

0 Karma
1 Solution

DalJeanis
SplunkTrust
SplunkTrust

Your code you showed us CANNOT EVER get a result of "Other" because the last eval will set every record to "Error2", regardless of what kind of record it is.

Try something like this and see what you get.

sourcetype="SourceA" ERROR NOT "GET-INFO" NOT "GET-ArchivedInfo" 
| eval ErrType=case(match(_raw,"Error 1 Message string"),"Error1",
     match(_raw,"Error 2 message"),"Error1",
    true(),"Other")

FIll in the "Error 1 Message String" with a string that will match only that kind of record. Remember to escape any periods or asterisks... in this case you can probably get away with just putting each one in square braces.... like [.] or [*]. If you can't figure out how to make the match logic work, then get on the splunk slack channel, #regex subchannel, and we can help you get it right.

View solution in original post

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Your code you showed us CANNOT EVER get a result of "Other" because the last eval will set every record to "Error2", regardless of what kind of record it is.

Try something like this and see what you get.

sourcetype="SourceA" ERROR NOT "GET-INFO" NOT "GET-ArchivedInfo" 
| eval ErrType=case(match(_raw,"Error 1 Message string"),"Error1",
     match(_raw,"Error 2 message"),"Error1",
    true(),"Other")

FIll in the "Error 1 Message String" with a string that will match only that kind of record. Remember to escape any periods or asterisks... in this case you can probably get away with just putting each one in square braces.... like [.] or [*]. If you can't figure out how to make the match logic work, then get on the splunk slack channel, #regex subchannel, and we can help you get it right.

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...