Splunk Search

Explicit Search/Alert for an Error

kvallala
Explorer

I am looking at setting up Search/Alert if i see an only "ERROR OGG-01296", however don't want to receive any alert when i have both errors "ERROR OGG-01296" and "ERROR OGG-01668" for the file  xxxxx.prm. How can exclusively ignore this patterns. Pls advise

2020-07-31T08:19:46.925-0700 ERROR OGG-01668 Oracle GoldenGate Delivery, xxxxx.prm: PROCESS ABENDING.

2020-07-31T08:19:46.924-0700 ERROR OGG-01296 Oracle GoldenGate Delivery, xxxxx.prm: Error mapping from LZ.ABCD to LZ.ABCD.

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

This should do it.

index=foo ("ERROR OGG-01296" OR "ERROR OGG-01668")
```Extract error code and file name```
| rex "ERROR OGG-(?<error>\d+)"
| rex ", (?<file>.*\.prm)"
```Combine error code for each file```
| stats count(error) as count by file
```Return only those files with a single error that is 1296```
| where (count=1 AND error=1296)
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

This should do it.

index=foo ("ERROR OGG-01296" OR "ERROR OGG-01668")
```Extract error code and file name```
| rex "ERROR OGG-(?<error>\d+)"
| rex ", (?<file>.*\.prm)"
```Combine error code for each file```
| stats count(error) as count by file
```Return only those files with a single error that is 1296```
| where (count=1 AND error=1296)
---
If this reply helps you, Karma would be appreciated.

kvallala
Explorer

Thanks @richgalloway , i definitely helping to my thought process.

I am still trying for what am looking for. Probably my question was not completely correct.

i might have more than one occurrence of this error.

ERROR OGG-01296

 However I should only report when i don't see Error 01668, and i see at least one occurrence of  OGG-01296 for that file xxxx.prm (for each file)

RROR OGG-01668

 

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...