Getting Data In

How do I make a Splunk query that reads all error code , it's message and count?

gauravepi
Path Finder

I have a JSON response now, and, from that, i want to create a table that will have all Unique Error Codes, Messages and Count . I am not able to read the JSON message in Splunk. How can we do this in Splunk? Below is one sample JSON response which i have

level:   DEBUG  
line:    43 
logger:  ErrorUtils 
message: Error: {"ErrorCode":"201","Message":"Invalid User"}    

I have created a query just to read the eventtype. i am not sure how i can proceed further on this.

eventtype="myevent"
Tags (2)
0 Karma

pramit46
Contributor

Assuming your json is properly formatted, try setting KV_Mode=json in your props.conf file against that sourcetype. It should automatically extract the field values from the json events.

You can read more about it here:
https://docs.splunk.com/Documentation/Splunk/latest/admin/Propsconf

Let me know if that helps.

0 Karma

Rob2520
Communicator

Can you share your whole JSON event?

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...