Splunk Search

Search strings and conditions together

satyajit2007
Explorer

Splunk is too powerful. But i wish the search criteria language would have been more generic something like sql 🙂

I have 3 buckets for error, warning and info for each source type.

Need help from experts

1) to add condition in error bucket like this.

 

 

level="ERROR" or log contains any of these ("Failed","Exception","Fatal")

 

 

 

2) also in dashboard line chart if i clicked on the error line, it should actually take me those error logs. Is it possible ?

 

 

 

<dashboard>
  <label>application Name</label>
  <description>Spark application logs</description>
  <row>
    <panel>
      <title>logs</title>
      <chart>
        <title>Streaming Error Count</title>
        <search>
          <query>index=myindex  sourcetype=mysourceType1 |  
           timechart count as total_logs count(eval(level="INFO")) as total_info  count(eval(level="WARN")) as total_warn count(eval(level="ERROR")) as total_error span=1h</query>
          <earliest>-7d@h</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.chart.showDataLabels">minmax</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
      </chart>
    </panel>
  </row>
</dashboard>

 

 

 

Labels (2)
0 Karma

satyajit2007
Explorer

It gives following error.

Error in 'timechart' command: The eval expression for dynamic field 'level="ERROR" OR ("Failed" OR "Exception" OR "Fatal") ' is invalid. Error='Type checking failed. 'OR' only takes boolean arguments.'.

 

 

 

 <query>index=myindex  sourcetype=mySourceTYpe |  
           timechart count as total_logs count(eval(level="INFO")) as total_info  count(eval(level="WARN")) as total_warn count(eval(level="ERROR" OR ("Failed" OR "Exception" OR "Fatal")  )  ) as total_error span=1h</query>
          <earliest>-7d@h</earliest>

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I think I understand why that failed.  Try this alternative.

index=myindex  sourcetype=mySourceTYpe 
| eval error = if(level="ERROR" OR searchmatch("Failed") OR searchmatch("Exception") OR searchmatch("Fatal"), 1, 0)
| timechart count as total_logs count(eval(level="INFO")) as total_info  count(eval(level="WARN")) as total_warn sum(error) as total_error span=1h
---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Have you seen the Splunk SPL for SQL Users manual?  https://docs.splunk.com/Documentation/Splunk/8.1.0/SearchReference/SQLtoSplunk

1) Without knowing the context, you can try

level="ERROR" OR ("Failed" OR "Exception" OR "Fatal")

2) The easiest way to do that is via the UI.  Edit the dashboard and click on the hamburger (triple-dot) icon in the panel  Select "Edit Drilldown".  Choose "Link to search" from the dropdown then select Custom.  Enter the search you want to run.  Use tokens to employ fields from the dashboard.  

---
If this reply helps you, Karma would be appreciated.
0 Karma

satyajit2007
Explorer

The OR condition is not working. will appreciate any help.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...