Splunk Search

Matching index field value with lookup field value

Loves-to-Learn Lots

If I am having 3 fields in lookup table as flow,InterfaceCode,DataError.

I am having a common field interfaceCode on index search 
| lookup CareerMarketplace.csv InterfaceCode as InterfaceCode output DataError
So i match lookup with above query .

With which serach strings I can exactly get these erros :(suggest possible commands with this fields Dataerror match with MessageText and display only these two error)
1. [ART.117.4002] Adapter Runtime (Adapter Service): Unable to invoke adapter service cip.atsJob.connectors.cipdb.jobCatalog:saveJobCatalog with connection cip.atsJob.connectors.cipdb:atsJobDb. [ADA.1.316] Cannot execute the SQL statement "?= call SAVE_JOB_CATALOG( ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)". " (23000/1400) ORA-01400: cannot insert NULL into ("ATSJOB"."ATS_JOB_CATALOG"."JOB_TITLE") ORA-06512: at "ATSJOB.SAVE_JOB_CATALOG", line 55 ORA-06512: at line 1

2. Error in ATS_JOB_FEED.AVATURE_GLOBAL job processing either jobTitle or JobDescription value is null,chk ATS_JOB_CATALOG for job details using job code:%dynamic value% and ATS code:AVATURE_GLOBAL See CIP Framework Log for more details, Interface Code: ATS_JOB_FEED.AVATURE_GLOBAL

DataError filed values of lookup match with MessageText of IndexSearch

How Can I get only these two errors not others as a result,,,?

Labels (3)
0 Karma
Get Updates on the Splunk Community!

There's No Place Like Chrome and the Splunk Platform

Watch On DemandMalware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

The Great Resilience Quest: 5th Leaderboard Update

The fifth leaderboard update for The Great Resilience Quest is out >> 🏆 Check out the ...

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...