Splunk Search

How to extract error codes coming within single event?

pradeepkm
Explorer

I have an event which contains error reason  codes of failed records . I have to extract these reason codes and get a count of each of these reason codes.

Labels (4)
Tags (1)
0 Karma

venky1544
Builder

Hi @pradeepkm 

is this a multline event  ???  

your search | rex field=_raw "Reason code::(?<Reason_code>[\w+ ]+)" |stats count by Reason_code 

0 Karma

pradeepkm
Explorer

No all reason codes coming in single event .That’s where I have difficulty in gathering stats.

0 Karma

venky1544
Builder

Hi @pradeepkm 

just try the below search 

 index="response" sourcetype="new" | rex field=_raw "Reason code::(?<Reason_code>[\w+ ]+)" max_match=0 |stats count by Reason_code

i just ingested your data and ran the above search query jusr replace your search before the rex command 

venky1544_0-1649157083707.png

venky1544_1-1649157132995.png

if this helps karma points are appreciated 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @pradeepkm,

to extract these error codes you have to create a field using a regex and than use a stats command to aggregate them.

Only as an example, if you want to take the oracle errors that are always "ORAXXXX" where XXXX is a four digit number, you should use a search like this:

index=your_index
| rex "?(<ora_error>ORA\d+)"
| stats count BY ora_error

To better help you I'd need a sample of your logs.

Ciao.

Giuseppe

0 Karma

pradeepkm
Explorer

This is how my event looks like 

Processing started….

Record No 1
Reason code : :Component code not found 

Record No.3

Reason code: :Address not found 

Record No.7

Reason code::Address not found 

processing ended at…

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...