Splunk Search

Finding success, failure data using deviceid

anushamkrishna
New Member

Hi,

I have log messages like this:

1) ECMSELECT_SERVICE_RESPONSEReceived Tru2way Proxy Sync Response - selectService, Status: OK, Status Message: Tuning to service:

2) OCAPRESP:Tru2Way Proxy received RPC call - tuning, Status: OK, Status Message: Received service context event, Tune Status: CA_ERROR

The log 1 gets printed whenever a successful channel is being tuned. And log 2 will get printed whenever the channel tunning fails. In the log 2, CA_ERROR is one type of error similarly i have 5 or 6 log messages for different errortypes. Now I need to form a query which gives me the result such as the number of successful channel tunes, number of channel tunes failed based on the deviceId. So, basically it should display for each deviceId how many channel tunes were success and how many got failed. How to frame thee query for this?

0 Karma

kddenton
Explorer

This is a simple query, do you have these fields mapped yet and if so which ones?

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security(ES) 7.3 is approaching the end of support. Get ready for ...

Hi friends!    At Splunk, your product success is our top priority. With Enterprise Security (ES), we're here ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk, and empower your SOC to reach new heights! Duration: 1 hour  Prepare to ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...