Splunk Search

Can we use regular expressions in lookups to match the errors in log files?

ashwinipatil198
Explorer

Hi,

I have a log file which has a set of errors
1) ORA-[0-9] errors. For eg: ORA-00054, ORA-00034,ORA-00056 etc
2) DBException
3) DEException
etc..

I have created a lookup to map the above errors to respective error_category and error_messages.

Can I have a regular expression mentioned in lookup to match every type of ORA-[0-9] errors. How will the regular expression be written in the lookup file?

Sample of lookup file:

sourcetype,filter,error_category,error_message,match,begin
LOADER,DBException.,Major,Database business exception.,1,0
LOADER,Application not working properly,Major,The configured file stores may not be present or may not have the proper rights or the other possibility is the failure of database connection.,1,0
LOADER,No space left on device,Major,Not enough space to carry out the processing.,1,0
LOADER,DEException,Major,Application exception.,1,0
LOADER,Error from House keeping component.,Critical,Error from House keeping component.,1,0
LOADER,ERROR.,Major,Error Occurred which will halt the processing.,1,0
LOADER,|ORA-[0-9]|,Major,ORA-00054 Error Occurred which will halt the processing.,1,0

Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

I've tried something similar and (AFAIK) lookups cannot do regex.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...