Splunk Search

How to match the beginning of a log line in a Splunk search?

Path Finder

I have events from an application containing various logger type messages, I.e: INFO, WARN, ERROR... Searching just for the string 'ERROR' returns false positives as some INFO messages contain a matching string pertaining to error detection and such... How do I match these events similar to 'grep ^ERROR '?

1 Solution

Legend

Try with regex. If you want to search for events with ERROR in the start of the event, try this

your base search | regex _raw="^ERROR"

View solution in original post

Legend

Try with regex. If you want to search for events with ERROR in the start of the event, try this

your base search | regex _raw="^ERROR"

View solution in original post

Builder

You could extract the log level in a field (if it isn't being done automatically). You could use the Interactive Field Extractor for this, or specify your own props/transforms. Having done so, you could search for log_level = INFO|WARN|ERROR.

For version 6.4.0 -> Settings -> Fields -> Field Extractions -> Open Field Extractor

You can also search for the events, click on the left most row expansion button, and select "Extract Fields" from the "Event Actions" menu.

This should get you started.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!