String formating

[Satyapv]

Hello All,

I have an Index = Application123 and it contains an Unique ID known as TraceNumber. For each Trace number we have Error's, Exceptions and return codes.

We have a requirements to summarize in a table  Like below, If error is found in index need table value as YES if not found it should be No. Same for Exception if Exception is found then table should be Yes or else no. Note Error's, exceptions and retuncodes are in content of Index with field - Message log.

TraceNumber   Error     Exception    ReturnCode

11111                  YES          NO                   YES

1234                     YES          NO                    YES

Any help would be appreciated

[Satyapv]

They are not extracted. They are part of log entries. Also is there a possibility to display complete Error or exception on last column?

TraceNumber   Error     Exception    ReturnCode Complete/Error or Exception

11111                  YES          NO                   YES               Full Exception....................................

1234                     YES          NO                    YES              Full Error........................

[ITWhisperer]

If they are not already extracted, you need to extract the trace number and error codes etc. If you need help with this, you will need to share some representative anonymised versions of your events, with details of what you want extracted e.g. what part of the event goes into which field.

[gcusello]

Hi @Satyapv,

let me understand: for each TraceNumber you can have Error="yes" (or something else) or Exception="yes" (or something else) and    ReturnCode="yes" (or something else).You want in a table the TraceNumber and in different columns Error, Exception and ReturnCode ="yes" if there's something or "NO" if there's nothing, is it correct?

In this case, you have to use the fillnull command to give the values when there's no value, something like this:

index=Application123 TraceNumber=*
| eval
   Error=if(Error="*","YES","NO"),
   Exception=if(Exception="*","YES","NO"),
   ReturnCode=if(ReturnCode="*","YES","NO")
| table TraceNumber Error Exception ReturnCode

It's not clear fom me if the  Error, Exception and ReturnCode fields are already extracted or not, if not, please share some sample so I can help you inextraction.

Ciao.

Giuseppe