Hello, I have the splunk query below which has multiple sourcetype rows and if the row has x-correlation-id keywpord matching it needs to return Status x-correlation-id (or) return missing otherwise,...
See more...
Hello, I have the splunk query below which has multiple sourcetype rows and if the row has x-correlation-id keywpord matching it needs to return Status x-correlation-id (or) return missing otherwise, there are couple of rows which has x-correlation-id in header and all rows are currently returning as "missing" , any ideas why the match is not working ?
environment=prod sourcetype=* "x-correlation-id" | fields sourcetype, Properties.Headers{} , Properties.CorrelationId, CorrelationId, Category | eval Status=if(match("Properties.Headers{}", "X-Correlation-id"),"x-correlation-id", "missing") | dedup sourcetype | table sourcetype,Status, Properties.CorrelationId, CorrelationId, Category | sort str(Properties.Headers{})
sourcetype status Properties.CorrelationId
o1 missing c1
o2 missing c2
o3 missing c3
o4 missing c4
o5 missing c5
o6 missing c6
o7 missing c7
08 missing c8