Splunk Search

How to match the beginning of a log line in a Splunk search?

bbialek
Path Finder

I have events from an application containing various logger type messages, I.e: INFO, WARN, ERROR... Searching just for the string 'ERROR' returns false positives as some INFO messages contain a matching string pertaining to error detection and such... How do I match these events similar to 'grep ^ERROR '?

1 Solution

sundareshr
Legend

Try with regex. If you want to search for events with ERROR in the start of the event, try this

your base search | regex _raw="^ERROR"

View solution in original post

sundareshr
Legend

Try with regex. If you want to search for events with ERROR in the start of the event, try this

your base search | regex _raw="^ERROR"

View solution in original post

sk314
Builder

You could extract the log level in a field (if it isn't being done automatically). You could use the Interactive Field Extractor for this, or specify your own props/transforms. Having done so, you could search for log_level = INFO|WARN|ERROR.

For version 6.4.0 -> Settings -> Fields -> Field Extractions -> Open Field Extractor

You can also search for the events, click on the left most row expansion button, and select "Extract Fields" from the "Event Actions" menu.

This should get you started.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!