Splunk Search

String formating

Satyapv
Engager

Hello All,

 

I have an Index = Application123 and it contains an Unique ID known as TraceNumber. For each Trace number we have Error's, Exceptions and return codes.

 

We have a requirements to summarize in a table  Like below, If error is found in index need table value as YES if not found it should be No. Same for Exception if Exception is found then table should be Yes or else no. Note Error's, exceptions and retuncodes are in content of Index with field - Message log.

TraceNumber   Error     Exception    ReturnCode

11111                  YES          NO                   YES

1234                     YES          NO                    YES

Any help would be appreciated

0 Karma

Satyapv
Engager

They are not extracted. They are part of log entries. Also is there a possibility to display complete Error or exception on last column?

 

TraceNumber   Error     Exception    ReturnCode Complete/Error or Exception

11111                  YES          NO                   YES               Full Exception....................................

1234                     YES          NO                    YES              Full Error........................

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

If they are not already extracted, you need to extract the trace number and error codes etc. If you need help with this, you will need to share some representative anonymised versions of your events, with details of what you want extracted e.g. what part of the event goes into which field.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Satyapv,

let me understand: for each TraceNumber you can have Error="yes" (or something else) or Exception="yes" (or something else) and    ReturnCode="yes" (or something else).You want in a table the TraceNumber and in different columns Error, Exception and ReturnCode ="yes" if there's something or "NO" if there's nothing, is it correct?

In this case, you have to use the fillnull command to give the values when there's no value, something like this:

index=Application123 TraceNumber=*
| eval
   Error=if(Error="*","YES","NO"),
   Exception=if(Exception="*","YES","NO"),
   ReturnCode=if(ReturnCode="*","YES","NO")
| table TraceNumber Error Exception ReturnCode

It's not clear fom me if the  Error, Exception and ReturnCode fields are already extracted or not, if not, please share some sample so I can help you inextraction.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...