Splunk Search

How to correlate error codes with the PDF documents, KEDB ?

sunrise
Contributor

I want to introduce Splunk to IT operations.
One of our operations is to investigate the problem with error codes of other products,
for example, IBM, Oracle, and so on.
The environment is offline, namely not on internet.
So now we must correlate the error code of third product log file with its public manuals (PDF files) and our KEDB (Knows Error Data Base).
KEDB is not anything great, actually Excel file, text file.
But it is full of our know-how and experiments.

So I vaguely have a question that how other users correlate such error codes to their past experimental databases and PDF manuals with Splunk.

Implementing databases with DB Connector Apps ?
or simply linking to CSV files ?
Can Splunk link the error codes to PDF manuals easily ?

I want to listen to other users' opinions.
Thank you very much for help.

Tags (2)
1 Solution

LukeMurphey
Champion

How can the error code be matched up to the PDF? It is as simple as a one-to-one match? If so, you could probably just use a lookup (CSV) file which matches up the error code to the URL and produces a new field with the URL (like error_code_url).

If you really want to make the link easy to use, you could make a custom event renderer that converts the field into a URL.

View solution in original post

0 Karma

LukeMurphey
Champion

How can the error code be matched up to the PDF? It is as simple as a one-to-one match? If so, you could probably just use a lookup (CSV) file which matches up the error code to the URL and produces a new field with the URL (like error_code_url).

If you really want to make the link easy to use, you could make a custom event renderer that converts the field into a URL.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Rounding off the Splunk Dashboard Contest

What does a contest-winning Splunk dashboard look like? In this case, it isn't in a browser tab at all. It ...

A Four Part Event Series: AI + Observability: AI Agents, LLMs, Apps, & Infrastructure

AI + Observability: AI Agents, LLMs, Apps, & Infrastructure The rapid evolution of artificial intelligence ...

Splunk Technical Support Is Moving to Cisco Support Tools

Introduction Splunk technical support is transitioning to Cisco’s support environment. This change brings ...