Splunk Search

How to edit my search to trigger an alert based on an error message field?

splunker9999
Path Finder

Hi , we need to create an alert and trigger this to my team. Being that below is my search base query looks like

index=ios sourcetype=m1log  source=/logs/web/jboss/*/logs/*_s2.log "Connection failure has been detected”  OR "The connection was disconnected because of server shutdown”

and now we need to trigger this in a table format in email with below fields

_time  host   source    Errormessage

For Errormessage field can we do like this, would this give my expected result or we need to tweak any thing in eval?

|eval Errormessage=Connection failure has been detected|eval Errormessage="The connection was disconnected because of server shutdown"

Thanks

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Because there will be only one error message in one event, you don't want to create plain eval (BTW, in your eval statement, you're overwriting first message with 2nd, so your results will always show 2nd message), use the conditional eval based on raw data, something like this

index=ios sourcetype=m1log  source=/logs/web/jboss/*/logs/*_s2.log "Connection failure has been detected"  OR "The connection was disconnected because of server shutdown" | eval ErrorMessage=if(searchmatch("Connection failure has been detected"),"Connection failure has been detected","The connection was disconnected because of server shutdown") | table _time host source Errormessage

Another option will be to extract the error message from raw data using rex command, but for that we need some sample events.

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Because there will be only one error message in one event, you don't want to create plain eval (BTW, in your eval statement, you're overwriting first message with 2nd, so your results will always show 2nd message), use the conditional eval based on raw data, something like this

index=ios sourcetype=m1log  source=/logs/web/jboss/*/logs/*_s2.log "Connection failure has been detected"  OR "The connection was disconnected because of server shutdown" | eval ErrorMessage=if(searchmatch("Connection failure has been detected"),"Connection failure has been detected","The connection was disconnected because of server shutdown") | table _time host source Errormessage

Another option will be to extract the error message from raw data using rex command, but for that we need some sample events.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi splunker9999,
Initially I suggest to you to use double quotes around source source="/logs/web/jboss/*/logs/*_s2.log".

After I suggest to build your error message (e.g.: | eval mail_message=_time+" "+host+" "+source+" "+Errormessage) and pass it to the eMail in only one field.
The problem is that in the mail body you can pass only the first record, if you need to pass more than one you have to use an attachment (pdf or csv).

In addition beware to the body or attachment dimensions, because if they exceed your eMail limits, eMail will be blocked.

Beware to the Errormessage: the first one you showed is wrong , the correct one is the second Errormessage="The connection was disconnected because of server shutdown"

Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...