Splunk Search

Matching index field value with lookup field value

Naga1
Loves-to-Learn Lots

If I am having 3 fields in lookup table as flow,InterfaceCode,DataError.

I am having a common field interfaceCode on index search 
| lookup CareerMarketplace.csv InterfaceCode as InterfaceCode output DataError
So i match lookup with above query .

With which serach strings I can exactly get these erros :(suggest possible commands with this fields Dataerror match with MessageText and display only these two error)
1. [ART.117.4002] Adapter Runtime (Adapter Service): Unable to invoke adapter service cip.atsJob.connectors.cipdb.jobCatalog:saveJobCatalog with connection cip.atsJob.connectors.cipdb:atsJobDb. [ADA.1.316] Cannot execute the SQL statement "?= call SAVE_JOB_CATALOG( ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)". " (23000/1400) ORA-01400: cannot insert NULL into ("ATSJOB"."ATS_JOB_CATALOG"."JOB_TITLE") ORA-06512: at "ATSJOB.SAVE_JOB_CATALOG", line 55 ORA-06512: at line 1

2. Error in ATS_JOB_FEED.AVATURE_GLOBAL job processing either jobTitle or JobDescription value is null,chk ATS_JOB_CATALOG for job details using job code:%dynamic value% and ATS code:AVATURE_GLOBAL See CIP Framework Log for more details, Interface Code: ATS_JOB_FEED.AVATURE_GLOBAL

DataError filed values of lookup match with MessageText of IndexSearch

How Can I get only these two errors not others as a result,,,?

Labels (3)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...