Splunk Search

Rex in Case command?


Hi All

In the logs there are multiple Oracle codes with different reasons e.g.

Product Mapping Error ORA-20030: PKG_PRODUCTMAPPING.Usp_Getsyscodesforprocodes failed while checking if list of inputted pro_codes have all successfully been mapped. For network the following pro_codes were not mapped: A100036;

Product Mapping Error ORA-20029: PKG_PRODUCTMAPPING.Setdownstreammapping failed while checking for more than one possible sys_code mapping for a given pro_code (see sys_product_mapping for pro_code = D102124).

Product Mapping Error ORA-20027: PKG_PRODUCTMAPPING.Setdownstreammapping failed while checking list of PRO_CODE(s) for effective_date of 21-Apr-2013 00:00. List of products that don't have a status of Live for NEW customers: D102683(Withdrawn);

Is there a way to extract the code (A100036, D102124, D102683) depending on the Oracle error code?

I've been trying the following but getting an error saying "Error in 'eval' command: The expression is malformed. Expected )".

eval product_code=case( oracle_error_code=="ORA-20027", rex field=_raw "customers: (?<"product_code1.*>)(Withdrawn);" )

Tags (3)


You can't put just any command into an eval statement - you can only use the eval functions.

Also, you seem to be trying to do this in an "if then else" in a procedural kind of way. You need to rethink that with Splunk.

Try this instead

rex field=_raw "customers:\s+(?<product_code>.*?)\("
| rex field=_raw "pro_codes were not mapped:\s+(?<product_code>.*?)\;"
| rex field=_raw "pro_codes\s+= \s+(?<product_code>.*?)\)"

Splunk will only create the product_code field when the event matches the regular expression; each event will (hopefully) only match one of them.

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!