Getting Data In

How do I find unique errors from cronjobs sent to syslog?

cwheeler33
Explorer

I am trying to find all unique messages sent to syslog from specific machines
Splunk 6.6.8

Using the following bash command, I get what I want:

grep -v  "sendmail\|nrpe\|freshclam" /var/log/messages | cut -c27- |sort| uniq -c

The following Splunk search comes close, but cuts out some results:

host="srvr1" OR host="srvr2"  NOT ( sendmail OR nrpe OR freshclam )  | dedup process

As an example, I only get one of these lines instead of all three:

### init: Id "x" respawning too fast: disabled for 5 minutes
### init: Id "y" respawning too fast: disabled for 5 minutes
### init: Id "z" respawning too fast: disabled for 5 minutes

Splunk will only return one of those lines. If I do a general search for the other two errors, they are there in Splunk so they are captured. I tried a dedup on other fields, but so far "process" seems to be the best fit.

Any suggestions?

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@cwheeler33,

Try using substr and then dedup them

For e.g.

host="srvr1" OR host="srvr2"  NOT ( sendmail OR nrpe OR freshclam )  | eval message=substr(_raw,0,50)|table _raw,message|dedup message

You could change the _raw to the filed where you are getting the log messages if any and also change the character length to get sufficient text to decide the duplicates.

Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...