Splunk Search

How to combine multiple regex rules into single search query?

alwinaugustin
Engager

I have the following search queries:

 

 

 

API Error Alert
---------------
index=myindex sourcetype=my-app:app |spath message | regex message="^.*Error while creating account.*$" |dedup my_id_field

API Down Alert
---------------
index=myindex sourcetype=my-app:app | spath message | regex message="^.*api-down.*$" | dedup my_id_field

Update API Error
------------------
index=myindex sourcetype=my-app:app | spath message | regex message="^.*Error while updating trial account.*$" | dedup my_id_field

 

 

 

 I have some more of the same kind. It is checking against multiple messages using. regular expressions. Now I would like to create an email alert for all these events and would like combine all these into one query and so I can create a single alert rather than creating individual alerts. How can I combine these queries ? It should trigger the email alert if any of these conditions is true. I have tried the following, but it is not working. 

 

 

 

index=myindex sourcetype=my-app:app |spath message | regex message="^.*Error while creating account.*$" | regex message="^.*api-down.*$"|regex message="^.*Error while updating trial account.*$" |regex message="^.*JWT Token creation failed with error.*$" |regex message="^.*Error while fetching IPLookU.*$"

 

 

 

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index=myindex sourcetype=my-app:app |spath message | regex message="Error while creating account|api-down|Error while updating trial account|JWT Token creation failed with error|Error while fetching IPLookU"
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Use where clause rather than regex

index=myindex sourcetype=my-app:app
| spath message
| where match(message, "^.*Error while creating account.*$") OR
        match(message, "^.*api-down.*$") OR 
        match(message, "^.*Error while updating trial account.*$") OR
        match(message, "^.*JWT Token creation failed with error.*$") OR
        match(message, "^.*Error while fetching IPLookU.*$")
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...