Splunk Search

using rex inside map search

a2021cdev
Observer

index=error sourcetype=error_log "Retry counter reached"
| makemv delim="=",values
| dedup errId
| table errId 
       | map search="search index=error sourcetype=error_log $errId$ "Caused by" | head 1 | rex field=_raw  "MessageText=(?<FailureReason>.+) Please report to system admin"
       | eval FailureReason=\"$FailureReason$\"
       | eval errId=\"$errId$\""
| table errId, FailureReason

The above query does not show any results. If i run the searches separately, i do see the output. What is wrong with the query please?

Labels (1)
0 Karma

a2021cdev
Observer

The query does not meet my requirement. It only lists errId and not the failure reason. 

 

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

Hi @a2021cdev,

Since you are searching same index and sourcetype, you don't need map.  Try this:

index=error sourcetype=error_log "Retry counter reached" OR "Caused by"
| rex  "MessageText=(?<FailureReason>.+) Please report to system admin"
| stats max(FailureReason) by errId
0 Karma

a2021cdev
Observer

The query does not meet my requirement. It does not correlate errId with failure reason. 

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!