How to match the beginning of a log line in a Splunk search?

[bbialek]

I have events from an application containing various logger type messages, I.e: INFO, WARN, ERROR... Searching just for the string 'ERROR' returns false positives as some INFO messages contain a matching string pertaining to error detection and such... How do I match these events similar to 'grep ^ERROR '?

[sundareshr · Accepted solution]

Try with regex. If you want to search for events with ERROR in the start of the event, try this

your base search | regex _raw="^ERROR"

[sk314]

You could extract the log level in a field (if it isn't being done automatically). You could use the Interactive Field Extractor for this, or specify your own props/transforms. Having done so, you could search for log_level = INFO|WARN|ERROR.

For version 6.4.0 -> Settings -> Fields -> Field Extractions -> Open Field Extractor

You can also search for the events, click on the left most row expansion button, and select "Extract Fields" from the "Event Actions" menu.

This should get you started.