How to edit my search to trigger an alert based on an error message field?

[splunker9999]

Hi , we need to create an alert and trigger this to my team. Being that below is my search base query looks like

index=ios sourcetype=m1log  source=/logs/web/jboss/*/logs/*_s2.log "Connection failure has been detected”  OR "The connection was disconnected because of server shutdown”

and now we need to trigger this in a table format in email with below fields

_time  host   source    Errormessage

For Errormessage field can we do like this, would this give my expected result or we need to tweak any thing in eval?

|eval Errormessage=Connection failure has been detected|eval Errormessage="The connection was disconnected because of server shutdown"

Thanks

[somesoni2 · Accepted solution]

Because there will be only one error message in one event, you don't want to create plain eval (BTW, in your eval statement, you're overwriting first message with 2nd, so your results will always show 2nd message), use the conditional eval based on raw data, something like this

index=ios sourcetype=m1log  source=/logs/web/jboss/*/logs/*_s2.log "Connection failure has been detected"  OR "The connection was disconnected because of server shutdown" | eval ErrorMessage=if(searchmatch("Connection failure has been detected"),"Connection failure has been detected","The connection was disconnected because of server shutdown") | table _time host source Errormessage

Another option will be to extract the error message from raw data using rex command, but for that we need some sample events.

[gcusello]

Hi splunker9999,
Initially I suggest to you to use double quotes around source source="/logs/web/jboss/*/logs/*_s2.log".

After I suggest to build your error message (e.g.: | eval mail_message=_time+" "+host+" "+source+" "+Errormessage) and pass it to the eMail in only one field.
The problem is that in the mail body you can pass only the first record, if you need to pass more than one you have to use an attachment (pdf or csv).

In addition beware to the body or attachment dimensions, because if they exceed your eMail limits, eMail will be blocked.

Beware to the Errormessage: the first one you showed is wrong , the correct one is the second Errormessage="The connection was disconnected because of server shutdown"

Bye.
Giuseppe