Splunk Search

Explicit Search/Alert for an Error

kvallala
Explorer

I am looking at setting up Search/Alert if i see an only "ERROR OGG-01296", however don't want to receive any alert when i have both errors "ERROR OGG-01296" and "ERROR OGG-01668" for the file  xxxxx.prm. How can exclusively ignore this patterns. Pls advise

2020-07-31T08:19:46.925-0700 ERROR OGG-01668 Oracle GoldenGate Delivery, xxxxx.prm: PROCESS ABENDING.

2020-07-31T08:19:46.924-0700 ERROR OGG-01296 Oracle GoldenGate Delivery, xxxxx.prm: Error mapping from LZ.ABCD to LZ.ABCD.

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

This should do it.

index=foo ("ERROR OGG-01296" OR "ERROR OGG-01668")
```Extract error code and file name```
| rex "ERROR OGG-(?<error>\d+)"
| rex ", (?<file>.*\.prm)"
```Combine error code for each file```
| stats count(error) as count by file
```Return only those files with a single error that is 1296```
| where (count=1 AND error=1296)
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

This should do it.

index=foo ("ERROR OGG-01296" OR "ERROR OGG-01668")
```Extract error code and file name```
| rex "ERROR OGG-(?<error>\d+)"
| rex ", (?<file>.*\.prm)"
```Combine error code for each file```
| stats count(error) as count by file
```Return only those files with a single error that is 1296```
| where (count=1 AND error=1296)
---
If this reply helps you, Karma would be appreciated.

kvallala
Explorer

Thanks @richgalloway , i definitely helping to my thought process.

I am still trying for what am looking for. Probably my question was not completely correct.

i might have more than one occurrence of this error.

ERROR OGG-01296

 However I should only report when i don't see Error 01668, and i see at least one occurrence of  OGG-01296 for that file xxxx.prm (for each file)

RROR OGG-01668

 

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...