Splunk Search

How to Use IF or Case condition

alex5441
Explorer

Hi,

My logs are in following format:

{[-]

logger: .......

message: ..........

severity: Error

}

{[-]

exception: .........

logger: .......

message: ..........

severity: Error

}

my query is :

........| rex "\"exception\":\"(<ErrorMsg>.*?)\"" | table Application, ErrorMsg

 

The issue:

As some app logs have key "message" and some logs have both "exception" and "message".

How can I change my query that first it checks if there is key exception, if it does get the value of that key. If there is no Key exception check if there is key "message", if it does get the value of that.

My current query is able to get the value of exception (if I change exception to message, it gets the value of message. But trying to implement IF or CASE condition here) 

Labels (2)
0 Karma

ITWhisperer
Ultra Champion

Try something like:

| rex "(\"exception\":\"(?<ErrorMsg>.*?)\"|\"message\":\"(?<Message>.*?)\")"
0 Karma

alex5441
Explorer

Thank you ITWhisperer,

But I am getting error in compile:

error.PNG

 

0 Karma

ITWhisperer
Ultra Champion

Try with different names as in my example

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!