Splunk Search

How to ignore or replace a string of a certain value

ZYSanshou
Engager

So when an upstream error is logged in our splunk it has two fields that contain all the information about the error. So I created a nice little query to show a simple table of the two fields:

stats values(errorMessage) by errorCode

However for one of the error messages in the errorMessage field it can contain an id for the current transaction with the server. So when we scale up and release this table will contain hundreds of values for a single error type. Examples of the types of errors (obviously sanitized without actual data):

errorCode: Not Required, errorMessage: [Error: Not Required] 400: Downgrade for transactionId=00000000000: type=01 country=GB
errorCode: Not Required, errorMessage: [Error: Not Required] 400: Downgrade for transactionId=00000000001: type=01 country=GB
errorCode: Invalid Request Parameters, errorMessage: [Error: Invalid Request Parameters] 400: Value of 30 for field not valid
errorCode: undefined, errorMessage: [Error: undefined] 400: undefined
errorCode: undefined, errorMessage: [Error: undefined] 500: undefined

So I would like the values(errorMessage) to group the first two items as a single entry so if I could create a new variable without the transactionId or replacing it with the same value, the information would be much easier to read and present for error triage in our dashboard because the transaction id is not important for seeing an error trend.

Not super great with Regex but I feel there is something that would work to just find a field of numbers with a specific length and remove them or replace them. Is that possible?

Thanks

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

| rex mode=sed field=errorMessage "s/transactionId=[^:]+:/transactionId=txid:/g"

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

| rex mode=sed field=errorMessage "s/transactionId=[^:]+:/transactionId=txid:/g"
0 Karma

ZYSanshou
Engager

That worked. Thanks.

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...