Hello All,
I have an Index = Application123 and it contains an Unique ID known as TraceNumber. For each Trace number we have Error's, Exceptions and return codes.
We have a requirements to summarize in a table Like below, If error is found in index need table value as YES if not found it should be No. Same for Exception if Exception is found then table should be Yes or else no. Note Error's, exceptions and retuncodes are in content of Index with field - Message log.
TraceNumber Error Exception ReturnCode
11111 YES NO YES
1234 YES NO YES
Any help would be appreciated
They are not extracted. They are part of log entries. Also is there a possibility to display complete Error or exception on last column?
TraceNumber Error Exception ReturnCode Complete/Error or Exception
11111 YES NO YES Full Exception....................................
1234 YES NO YES Full Error........................
If they are not already extracted, you need to extract the trace number and error codes etc. If you need help with this, you will need to share some representative anonymised versions of your events, with details of what you want extracted e.g. what part of the event goes into which field.
Hi @Satyapv,
let me understand: for each TraceNumber you can have Error="yes" (or something else) or Exception="yes" (or something else) and ReturnCode="yes" (or something else).You want in a table the TraceNumber and in different columns Error, Exception and ReturnCode ="yes" if there's something or "NO" if there's nothing, is it correct?
In this case, you have to use the fillnull command to give the values when there's no value, something like this:
index=Application123 TraceNumber=*
| eval
Error=if(Error="*","YES","NO"),
Exception=if(Exception="*","YES","NO"),
ReturnCode=if(ReturnCode="*","YES","NO")
| table TraceNumber Error Exception ReturnCode
It's not clear fom me if the Error, Exception and ReturnCode fields are already extracted or not, if not, please share some sample so I can help you inextraction.
Ciao.
Giuseppe