Splunk Search

How can I extract a string named "CRASHED" from a field containing many strings while creating a dashboard?

gaurav_gg
New Member
CF_MSG(field name)  : "App instance exited with guid fd4c7738-1dea-449d-a13b-7856d843c5b3 payload: {\"instance\"=\u003e\"90f808fe-bdfa-434c-5bd1-b96e162042b1\", \"index\"=\u003e0, \"reason\"=\u003e\"CRASHED\", \"exit_description\"=\u003e\"2 error(s) occurred:\\n\\n* 1 error(s) occurred:\\n\\n* Codependent step exited\\n* cancelled\", \"crash_count\"=\u003e2, \"crash_timestamp\"=\u003e1479486559346525444, \"version\"=\u003e\"eb5e5ca2-fbb1-4d61-993a-73b13e37ea42\"

I am using this regex but its not giving me any output :

index=int_gcg_nam_pcf_application_prod 
CF_MSG=*CRASHED | stats count by CF_APP_NAME
0 Karma

gokadroid
Motivator

Searching for (CRASHED) or _raw="CRASHED" as @sundaresh advises will work great but will be searching overall on the event data. Since you already know the field in which the data is coming, CF_MSG, how about using that field itself to make it (maybe) slightly faster than "overall" searches for keyword CRASHED and to avoid catching a CRASHED which is not part of your field CF_MSG but elsewhere in overall raw data. So query you should be looking at besides the two @sundaresh provides is:

index=int_gcg_nam_pcf_application_prod CF_MSG=*(CRASHED)*| stats count by CF_APP_NAME
0 Karma

sundareshr
Legend

Try this

index=int_gcg_nam_pcf_application_prod CASE("*CRASHED*") | stats count by CF_APP_NAME

*OR*

index=int_gcg_nam_pcf_application_prod | regex _raw="CRASHED" | stats count by CF_APP_NAME
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...