Hi,
I want to search for a particular text, for example:
"Error.*CP:Link Change: Received Link UP for already active instance"'
and extract it as a field. That means I want to add this field as:
inst_Error="Error.*CP:Link Change: Received Link UP for already active instance"'
in Splunk.
So now using inst_error
, I want to form a search string as:
if severity=critical AND inst_error exists
Please help.
Hi shrirangphadke,
okay, I'll try it ....
your base search here to get the needed events | rex field=_raw "(?<inst_Error>Error\.\*CP.+)\"" | eval inst_Error=if(isnull(inst_Error), "null", inst_Error) | search severity=critical AND inst_error!="null"
This is un-tested since you did not provide any of your real world events.
But this will get you started....
cheers, MuS
Hi shrirangphadke,
okay, I'll try it ....
your base search here to get the needed events | rex field=_raw "(?<inst_Error>Error\.\*CP.+)\"" | eval inst_Error=if(isnull(inst_Error), "null", inst_Error) | search severity=critical AND inst_error!="null"
This is un-tested since you did not provide any of your real world events.
But this will get you started....
cheers, MuS
Thank you very much for answer, indeed it solved my problem, Thanks !
Thanks ! @ppablo_splunk
You're welcome @shrirangphadke 🙂