About marc_ukg

marc_ukg · ‎09-15-2020

Unfortunately, this doesn't help me as the data is already imported as one-record-per-line in Splunk. In the end, the resolution is really to fix the data. I've submitted a request to our engineering team to add the 'tenant' value to the ERROR lines rather than try to post-process the data. Thanks for the help.

marc_ukg · ‎09-14-2020

That appears to work, however: how would I go about returning the ERROR entry alongside the following INFO? It doesn't have to be combined into a single row but should return both rows (in case the ERROR line contains useful details to the cause of the failure). I researched 'streamstats' but could not see how to achieve this. How can I filter the returned records? Using the example data above, how would I exclude ERRORs on test3_nas_* Adding a | where clause to the records returned by streamstats did not appear to be the right approach. Meanwhile, adding NOT "test3_nas_*" to the base search replaces the INFO value with the ERROR _raw value instead, but still returns the same number of records.

marc_ukg · ‎09-11-2020

I have a log that contain records for tables processed in a database. For each table, a log entry is added showing the number of records to be processed. If processing fails for whatever reason, an ERROR is recorded. If processing succeeds, nothing is recorded. Sample log [ProcessId- 5459] [2020-08-29 06:22:34] [INFO] For tenant - test1_sales_nas_10, total number of records purged = 0 [ProcessId- 5459] [2020-08-29 06:22:34] [INFO] For tenant - test1_sales_nas_18, total number of records purged = 0 [ProcessId- 5459] [2020-08-29 06:22:34] [INFO] For tenant - test2_nas_01, total number of records purged = 0 [ProcessId- 5459] [2020-08-29 06:22:34] [INFO] For tenant - test3_nas_1113, total number of records purged = 0 [ProcessId- 5459] [2020-08-29 06:22:34] [ERROR] Error occurred during purging of records. Error code returned to shell script by DB function = -1. [ProcessId- 5459] [2020-08-29 06:22:34] [INFO] For tenant - test3_nas_1112, total number of records purged = 0 [ProcessId- 5459] [2020-08-29 06:22:34] [ERROR] Error occurred during purging of records. Error code returned to shell script by DB function = -1. There is nothing that links the ERROR record to the INFO record except for the order it happened. How can I create a search that returns records matching "Error occurred during purging of records" AND the previous record in the log to provide context for the error? I realize that this makes a huge assumption -- that the ERROR always refers to the records immediately above it -- but it's unfortunately the only thing I have to go off of. Any help is appreciated.

Posts	3
Solutions	0
Karma Given	2
Karma Received	0
Member Since	‎09-11-2020

Online Status	Offline
Date Last Visited	‎04-18-2022 01:51 PM

Return previous row when record matches

Re: Return previous row when record matches

Re: Return previous row when record matches

Return previous row when record matches