How to Remove dynamic part from error log and group by common error

[raghavendrasred]

I want to Remove dynamic part from error log and group by common error
below is the message which will be generated dynamic for each event.
WFFaultCode: 1010 and WFFaultReasonText: (CORE,9v7QgtZ4_pvny0yWx0=)<-10040106> An unhandled exception occurred in CommandExecutor or GroovyExecutor. Error: "(CORE,9v7QgZ4_pvny0yWx0=)<-11130016> To record, the transaction must be active.".

i want to group the above message with common message as shown below and display.
WFFaultCode: An unhandled exception occurred in CommandExecutor or GroovyExecutor. Error: To record, the transaction must be active.".

[richgalloway · Accepted solution]

I've done something similar this way.

<your search> | eval message=if(like(message,"WFFaultCode: % An unhandled exception occurred in CommandExecutor or GroovyExecutor. Error: % To record, the transaction must be active."),"WFFaultCode: An unhandled exception occurred in CommandExecutor or GroovyExecutor. Error: To record, the transaction must be active.",message) | ...

[raghavendrasred]

Thanks for the quick response.
with full message search as given by you in query it is default going for "message" and displaying message only.

when i tried below one it worked.
| eval message=if(like(message,"WFFaultCode:%"),"WFFaultCode: An unhandled exception occurred in CommandExecutor or GroovyExecutor. Error: To record, the transaction must be active.",message) | ...

Thanks. i got the idea. i will check it may be space or other issue.

[yuanliu]

I use case when dealing with such needs. It allows more varieties, although the basic idea is the same. Also, if you are familiar with regex, it can be more powerful if need be. E.g.,

| eval message=case(like(message,"WFFaultCode:%"),"WFFaultCode: An unhandled exception occurred in CommandExecutor or GroovyExecutor. Error: To record, the transaction must be active.",
  match(message,"^AnotherFaultCode: [1-5]\d{2} "),"AnotherFault (1xx - 5xx)..",
  1==1, message) | ...