Splunk Search

Omit an error code from a search

Engager

Hi all,

We are using one of the built-in search commands to look at the errors in the past 24 hours. However there are a lot of events with Error Code 0x0 that are showing up; 0x0 isn't really an error, so it's not useful having it there. Is there any way that we can omit this error code from the search?

This is the search entry: error OR failed OR severe OR ( sourcetype=access_* ( 404 OR 500 OR 503 ) )

Tags (2)
0 Karma
1 Solution

Path Finder

Hello,

you could try the following:

error OR failed OR severe OR (sourcetype=access_* (404 OR 500 OR 503)) NOT Error_Code="0x0*"

"NOT" will exclude the field "Error_Code" containing a code starting with "0x0"

View solution in original post

Path Finder

Hello,

you could try the following:

error OR failed OR severe OR (sourcetype=access_* (404 OR 500 OR 503)) NOT Error_Code="0x0*"

"NOT" will exclude the field "Error_Code" containing a code starting with "0x0"

View solution in original post

Engager

That did the trick. Thank you.

0 Karma