Splunk Search

Explicit Search/Alert for an Error

kvallala
Explorer

I am looking at setting up Search/Alert if i see an only "ERROR OGG-01296", however don't want to receive any alert when i have both errors "ERROR OGG-01296" and "ERROR OGG-01668" for the file  xxxxx.prm. How can exclusively ignore this patterns. Pls advise

2020-07-31T08:19:46.925-0700 ERROR OGG-01668 Oracle GoldenGate Delivery, xxxxx.prm: PROCESS ABENDING.

2020-07-31T08:19:46.924-0700 ERROR OGG-01296 Oracle GoldenGate Delivery, xxxxx.prm: Error mapping from LZ.ABCD to LZ.ABCD.

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

This should do it.

index=foo ("ERROR OGG-01296" OR "ERROR OGG-01668")
```Extract error code and file name```
| rex "ERROR OGG-(?<error>\d+)"
| rex ", (?<file>.*\.prm)"
```Combine error code for each file```
| stats count(error) as count by file
```Return only those files with a single error that is 1296```
| where (count=1 AND error=1296)
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

This should do it.

index=foo ("ERROR OGG-01296" OR "ERROR OGG-01668")
```Extract error code and file name```
| rex "ERROR OGG-(?<error>\d+)"
| rex ", (?<file>.*\.prm)"
```Combine error code for each file```
| stats count(error) as count by file
```Return only those files with a single error that is 1296```
| where (count=1 AND error=1296)
---
If this reply helps you, Karma would be appreciated.

kvallala
Explorer

Thanks @richgalloway , i definitely helping to my thought process.

I am still trying for what am looking for. Probably my question was not completely correct.

i might have more than one occurrence of this error.

ERROR OGG-01296

 However I should only report when i don't see Error 01668, and i see at least one occurrence of  OGG-01296 for that file xxxx.prm (for each file)

RROR OGG-01668

 

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...