Splunk Search

How to Remove dynamic part from error log and group by common error

raghavendrasred
New Member

I want to Remove dynamic part from error log and group by common error
below is the message which will be generated dynamic for each event.
WFFaultCode: 1010 and WFFaultReasonText: (CORE,9v7QgtZ4_pvny0yWx0=)<-10040106> An unhandled exception occurred in CommandExecutor or GroovyExecutor. Error: "(CORE,9v7QgZ4_pvny0yWx0=)<-11130016> To record, the transaction must be active.".

i want to group the above message with common message as shown below and display.
WFFaultCode: An unhandled exception occurred in CommandExecutor or GroovyExecutor. Error: To record, the transaction must be active.".

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

I've done something similar this way.

<your search> | eval message=if(like(message,"WFFaultCode: % An unhandled exception occurred in CommandExecutor or GroovyExecutor. Error: % To record, the transaction must be active."),"WFFaultCode: An unhandled exception occurred in CommandExecutor or GroovyExecutor. Error: To record, the transaction must be active.",message) | ...
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I've done something similar this way.

<your search> | eval message=if(like(message,"WFFaultCode: % An unhandled exception occurred in CommandExecutor or GroovyExecutor. Error: % To record, the transaction must be active."),"WFFaultCode: An unhandled exception occurred in CommandExecutor or GroovyExecutor. Error: To record, the transaction must be active.",message) | ...
---
If this reply helps you, Karma would be appreciated.
0 Karma

raghavendrasred
New Member

Thanks for the quick response.
with full message search as given by you in query it is default going for "message" and displaying message only.

when i tried below one it worked.
| eval message=if(like(message,"WFFaultCode:%"),"WFFaultCode: An unhandled exception occurred in CommandExecutor or GroovyExecutor. Error: To record, the transaction must be active.",message) | ...

Thanks. i got the idea. i will check it may be space or other issue.

0 Karma

yuanliu
SplunkTrust
SplunkTrust

I use case when dealing with such needs. It allows more varieties, although the basic idea is the same. Also, if you are familiar with regex, it can be more powerful if need be. E.g.,

| eval message=case(like(message,"WFFaultCode:%"),"WFFaultCode: An unhandled exception occurred in CommandExecutor or GroovyExecutor. Error: To record, the transaction must be active.",
  match(message,"^AnotherFaultCode: [1-5]\d{2} "),"AnotherFault (1xx - 5xx)..",
  1==1, message) | ...
0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...