Splunk Search

Am I doing this search correctly? where like()

HCadmins
Communicator

Hi:

Take a look at this ESXi log

2015-11-09T21:53:54.589Z cpu28:37021)MCE: 231: cpu28: bank7: MCA recoverable error (CE): "Memory Controller Read Error on Channel 0."

Using regex, I've extracted cpu28:37021) as field CPU and MCE: 231: cpu28: bank7: MCA recoverable error (CE): "Memory Controller Read Error on Channel 0."` as CPU_Message.

Now, I want to create a report that looks for the keywords MCE or MCA in the CPU_Message field. Doing wildcards won't work because there could be other words that contain mca or mce in them. I want to be alerted on any MCA or MCE errors specifically.

I've built this search

sourcetype=vmware:esxlog* | where like(CPU_Message, MCE) OR like(CPU_Message, MCA) | table host CPU CPU_Message

Will this accomplish what I want to do?

Thanks in advance!

0 Karma
1 Solution

sundareshr
Legend

Try this

sourcetype=vmware:esxlog* | where match(CPU_Message, "MC[E|A]") AND NOT match(CPU_Message, "recoverable") | table host CPU CPU_Message

This looks for an exact (regex) case-sensitive match

View solution in original post

0 Karma

sundareshr
Legend

Try this

sourcetype=vmware:esxlog* | where match(CPU_Message, "MC[E|A]") AND NOT match(CPU_Message, "recoverable") | table host CPU CPU_Message

This looks for an exact (regex) case-sensitive match

0 Karma

HCadmins
Communicator

Thank you! That worked well. Now how to I also exclude the word "recoverable"?

0 Karma

sundareshr
Legend

Try the updated query

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...