I have a lookup file which has below 3 columns.
Exception_Name Exception_Keyword Comments
REXC RemoteException Alerted
JNEXC Exception-NullPointer Ignorable
Now in the logs when the Exception_Keyword occurs,It should look for the lookupfile and take the Exception_Name,Comments and give the result with host and count also.
And if the Exception_Keyword does not exists in lookup it should be listed as New..
Expected output as below :
Exception Name Host Count Comments
REXC ABC 27 Alerted
javanull ABC 3 New
Kindly help please.
it should be near your request:
index=your_index | rename _raw as rawText | eval pattern=[ | inputlookup exceptions.csv | stats values(Exception_Keyword) AS query | eval query=mvjoin(query,",") | fields query | format "" "" "" "" "" "" ] | eval pattern=split(pattern,",") | mvexpand pattern | eval pattern="%".pattern."%" | eval check=if(like(rawText,pattern),pattern,"No") | rex field=pattern "\%(?<pattern>[^\%]*)\%" | lookup exceptions.csv Exception_Keyword AS pattern OUTPUT Exception_Name Comments | fillnull value="New" Comments | stats values(Comments) AS Comments count BY Exception_Name host