Splunk Search

If / Then Conditional.

codichulo
Loves-to-Learn

Heres what i'm trying to accomplish: 

requestID               status
123456                   errored
321654                  Success
789456                 errored

I'm Newbie, Maybe i'm going about this all wrong, and there maybe another way....but i don't think so based on what info i have. but heres what i got so far. I'm probably over-thinking this. 

index=someindex sourcetype=sometype "request syntax" OR "error syntax" OR "success syntax"
| rex field=_raw "request id: '(?<requestID>\d+)',\text"
| rex field=_raw ".*(?<error>Error response received)\stext"
| rex field=_raw ".*(?<Success>Database request executed):\stext"
| eval requestID =if(requestID=(error),"Errored", "Success")


Labels (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

There are a couple of oddities/errors in your query, e.g. there is no 's' after the \ in the request ID rex statement and the if statement would not need the () round error, however, it depends on your data as to what your query should look like - can you provide a sample?

However,  from your example query, this might be better (I have removed the trailing data outside the field capture group

index=someindex sourcetype=sometype "request syntax" OR "error syntax" OR "success syntax"
| rex field=_raw "request id: '(?<requestID>\d+)'"
| rex field=_raw ".*(?<error>Error response received)"
| rex field=_raw ".*(?<Success>Database request executed)"
| eval status=if(requestID=error,"Errored", "Success")

this is assuming that the rex statement extracting the field 'error' will give the same value as the requestID field. What is your intention with Success field extraction 

0 Karma

codichulo
Loves-to-Learn

oh sorry, the rex statements are working fine, i just removed identifiable info to make them look generic, and in doing so made them look in error. 

it was the eval statement that i couldn't get to work right. I'll try your suggestion. Thanks so much. 

 

0 Karma

to4kawa
Ultra Champion

what's the logs.
your regex is not good.

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...