Splunk Search

String formating

Satyapv
Engager

Hello All,

 

I have an Index = Application123 and it contains an Unique ID known as TraceNumber. For each Trace number we have Error's, Exceptions and return codes.

 

We have a requirements to summarize in a table  Like below, If error is found in index need table value as YES if not found it should be No. Same for Exception if Exception is found then table should be Yes or else no. Note Error's, exceptions and retuncodes are in content of Index with field - Message log.

TraceNumber   Error     Exception    ReturnCode

11111                  YES          NO                   YES

1234                     YES          NO                    YES

Any help would be appreciated

0 Karma

Satyapv
Engager

They are not extracted. They are part of log entries. Also is there a possibility to display complete Error or exception on last column?

 

TraceNumber   Error     Exception    ReturnCode Complete/Error or Exception

11111                  YES          NO                   YES               Full Exception....................................

1234                     YES          NO                    YES              Full Error........................

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

If they are not already extracted, you need to extract the trace number and error codes etc. If you need help with this, you will need to share some representative anonymised versions of your events, with details of what you want extracted e.g. what part of the event goes into which field.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Satyapv,

let me understand: for each TraceNumber you can have Error="yes" (or something else) or Exception="yes" (or something else) and    ReturnCode="yes" (or something else).You want in a table the TraceNumber and in different columns Error, Exception and ReturnCode ="yes" if there's something or "NO" if there's nothing, is it correct?

In this case, you have to use the fillnull command to give the values when there's no value, something like this:

index=Application123 TraceNumber=*
| eval
   Error=if(Error="*","YES","NO"),
   Exception=if(Exception="*","YES","NO"),
   ReturnCode=if(ReturnCode="*","YES","NO")
| table TraceNumber Error Exception ReturnCode

It's not clear fom me if the  Error, Exception and ReturnCode fields are already extracted or not, if not, please share some sample so I can help you inextraction.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...