Splunk Search

Search strings and conditions together

satyajit2007
Explorer

Splunk is too powerful. But i wish the search criteria language would have been more generic something like sql 🙂

I have 3 buckets for error, warning and info for each source type.

Need help from experts

1) to add condition in error bucket like this.

 

 

level="ERROR" or log contains any of these ("Failed","Exception","Fatal")

 

 

 

2) also in dashboard line chart if i clicked on the error line, it should actually take me those error logs. Is it possible ?

 

 

 

<dashboard>
  <label>application Name</label>
  <description>Spark application logs</description>
  <row>
    <panel>
      <title>logs</title>
      <chart>
        <title>Streaming Error Count</title>
        <search>
          <query>index=myindex  sourcetype=mysourceType1 |  
           timechart count as total_logs count(eval(level="INFO")) as total_info  count(eval(level="WARN")) as total_warn count(eval(level="ERROR")) as total_error span=1h</query>
          <earliest>-7d@h</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.chart.showDataLabels">minmax</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
      </chart>
    </panel>
  </row>
</dashboard>

 

 

 

Labels (2)
0 Karma

satyajit2007
Explorer

It gives following error.

Error in 'timechart' command: The eval expression for dynamic field 'level="ERROR" OR ("Failed" OR "Exception" OR "Fatal") ' is invalid. Error='Type checking failed. 'OR' only takes boolean arguments.'.

 

 

 

 <query>index=myindex  sourcetype=mySourceTYpe |  
           timechart count as total_logs count(eval(level="INFO")) as total_info  count(eval(level="WARN")) as total_warn count(eval(level="ERROR" OR ("Failed" OR "Exception" OR "Fatal")  )  ) as total_error span=1h</query>
          <earliest>-7d@h</earliest>

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I think I understand why that failed.  Try this alternative.

index=myindex  sourcetype=mySourceTYpe 
| eval error = if(level="ERROR" OR searchmatch("Failed") OR searchmatch("Exception") OR searchmatch("Fatal"), 1, 0)
| timechart count as total_logs count(eval(level="INFO")) as total_info  count(eval(level="WARN")) as total_warn sum(error) as total_error span=1h
---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Have you seen the Splunk SPL for SQL Users manual?  https://docs.splunk.com/Documentation/Splunk/8.1.0/SearchReference/SQLtoSplunk

1) Without knowing the context, you can try

level="ERROR" OR ("Failed" OR "Exception" OR "Fatal")

2) The easiest way to do that is via the UI.  Edit the dashboard and click on the hamburger (triple-dot) icon in the panel  Select "Edit Drilldown".  Choose "Link to search" from the dropdown then select Custom.  Enter the search you want to run.  Use tokens to employ fields from the dashboard.  

---
If this reply helps you, Karma would be appreciated.
0 Karma

satyajit2007
Explorer

The OR condition is not working. will appreciate any help.

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...