Splunk Search

How to create a dashboard search with the condition "If status is not success, show error code, type, and message on the same row"?

splgeek
Explorer

I want to create a dashboard with a table listing integration name and execution status with the following condition:

If execution status is different than success -> on same row, show error code, error type, and error message

0 Karma

splgeek
Explorer

I extracted Log.Execution.Status as a field , and now its pulls up all the status

How do i add another row in the table for this logic

If execution status is different than success -> on same row, show error code, error type, and error message

0 Karma

gokadroid
Motivator

Assuming the fields integrationName, executionStatus (success/failure), errorCode, errorType and errorMessage are already extracted use below

yourQuery to return all the fields
| table  integrationName, executionStatus, errorCode, errorType and errorMessage | where executionStatus!="success"
0 Karma

splgeek
Explorer
index=ko_mulesoft source="*" source="*" "LOG.Execution.Status"="*" | table source, LOG.Execution.Status

Above search got me 278 3 results.

Next part to achieve is
if execution status is different than success -> on same row, show error code, error type and error message

How do I achieve that?

0 Karma

gokadroid
Motivator

Looks like the "LOG.Execution.Status" is part of your data as a string and not as a field. You need to first extract the fields from your data strings

How to extract fields, see here:
http://docs.splunk.com/Documentation/Splunk/6.5.0/Knowledge/ExtractfieldsinteractivelywithIFX
http://docs.splunk.com/Documentation/Splunk/6.5.0/Knowledge/Managesearch-timefieldextractions

Once the fields are extracted then you should run the query I put in where each of these is a Field in which your event data is saved as a result.

integrationName, executionStatus, errorCode, errorType and errorMessage

Else if you can paste your mulesoft log line here which has all the required data which you want to extract info from so I can assist you with the fields extraction.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...