Splunk Search

Derive fields from the search params

ericchile
New Member

How can I create a field for different search params and include others as well? Ie

source="/location/to/file" "error" AND ("This is one error" OR "this is another error" OR "this is the last error" | fieldchart count

So that the chart shows the count of each type of error and all the rest are grouped in "other"?

Splunk Novice here so any help would be nice!

Thank you!!

Tags (1)
0 Karma

ericchile
New Member

Sweet. Thank you so much!

0 Karma

chris
Motivator

Hi,

you could try something like this:

 source="/location/to/file" | rex "(?<special_error>This is one error)" | rex "(?<special_error>this is another error)" | eval error_type=if(isnotnull(special_error),special_error,"other") | stats count by error_type

Just a few thoughts on the search

  • it usually makes sense to search for a sourcetype instead of a source
  • rex will extract a field
  • by chaining 2 (or more rexes) for events with a differen format a field with the same name will be created
  • if the error message ist always in the same position of your events a regular expression can be used to catch all the special error messages you want
  • to automate things you can configure the props.conf & transforms.conf to extract fields automatically (step 2)

If you can post some sample events it will be easier to help.

Good luck

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...