Splunk Search

How to write case statement for below log?

Emyamy
Explorer

Hi Splunkers.

I have two level of logs (NOTICE,ERROR), for Error logs(json), method_name and message is automatically getting extracted but not for NOTICE logs, So i have written my case statement like below in UI  and its working fine but im not sure how to deploy this in props.conf

 

index=index_name sourcetype=sourctype_name  log_level=NOTICE
|eval message =case(method_name='protopayload.table.create'=="table created",method_name='protopayload.table.delete'=="table deleted")

i dont want to write case statement for error logs as its already getting extracted fine.

to be precise:- i want my fields extraction to happen automatically for error logs (as its getting extracted automatically) and want my case statement work only for notice logs.

 

Please assist on this

 

 

 

 

Labels (6)
Tags (1)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @Emyamy,

You can user below search for test and put EVAL setting in your sourcetype settings for extraction.

Search sample;
|eval message =case(log_level="NOTICE" AND method_name="protopayload.table.create","table created",log_level="NOTICE" AND method_name="protopayload.table.delete","table deleted")

props.conf
EVAL-message =case(log_level="NOTICE" AND method_name="protopayload.table.create","table created",log_level="NOTICE" AND method_name="protopayload.table.delete","table deleted")

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @Emyamy,

You can user below search for test and put EVAL setting in your sourcetype settings for extraction.

Search sample;
|eval message =case(log_level="NOTICE" AND method_name="protopayload.table.create","table created",log_level="NOTICE" AND method_name="protopayload.table.delete","table deleted")

props.conf
EVAL-message =case(log_level="NOTICE" AND method_name="protopayload.table.create","table created",log_level="NOTICE" AND method_name="protopayload.table.delete","table deleted")

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

yuanliu
SplunkTrust
SplunkTrust
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...