Splunk Search

Importing error code reasons from URL to Splunk query

NizanCohen
Explorer

Hi all.

My company is working with GlobalScope and I wish to enter their error code description to Splunk.

As of right now, I only get the error number and I need to go to their website and check what is each code. I was wondering if I can import the data from the website into my Splunk and include it on my queries.

Here's the url: https://kb.globalscape.com/Knowledgebase/10142/FTP-Status-and-Error-Codes

Labels (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

Absolutely.  Just put the table into a CSV file, e.g., like

CodeDescriptionDiscussion
100 requested action was initiated; expect another reply before proceeding with a new command.
110Restart markerreply. The text is exact and not left to the particular implementation; it must read "MARK yyyy = mmmm" where yyyy is User-process data stream marker, and mmmm server's equivalent marker (note the spaces between markers and "=").
120Service readynn minutes. (Informational)
125Data Connectionalready open; transfer starting. (Informational)
150File statusokay; about to open data connection. FTP uses two ports: 21 for sending commands, and 20 for sending data. A status code of 150 indicates that the server is about to open a new connection on port 20 to send some data.

Set up the CSV as lookup. (See Define a CSV lookup in Splunk Web.)  Then, suppose your data search returns a field named ftp_return_code.  In your search, add a lookup command

 

| lookup mylookup Code as ftp_return_code OUTPUT Description as ftp_return_description, Discussion as ftp_return_discussion

 

 

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...