Splunk Search

Case with multiple potential wildcard matches

aohls
Contributor

I have a field with error messages that I need a case statement to cleanup for reporting. In this case some of the messages contain ID's which make the report long as each error has a unique ID. I want to lean this up by using something like

eval error=case(like(error, "%DB Error"), "Database error", like(error, "%network Error", "Network Error"))... Etc.

I am not getting the matches that I should be getting with this though, still the full errors are showing. Is there a better way to accomplish this?

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could try using match something like this

eval error=case(match(error, "DB Error"), "Database error", match(error, "network Error"), "Network Error")... Etc.
0 Karma

aohls
Contributor

I should add that there are two fields I need to try to use. There is a error code and error description and the description has an id in it, so it could be "Database Error: 1234" and another is "Database Code: 3214". I want to combine these to just be "Database Error".

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Since match uses regex, you can combine them so long as you can define a regex expression.

| makeresults 
| eval _raw="message Database Error: 1234
other message Database Code: 3214"
| multikv noheader=t
| eval error=case(match(_raw,"Database (Error|Code): \d+"),"Database Error",1==1,"Other Error")
| table _raw error
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...