Hi all,
I am a very new splunk user and would like to conduct produce a table with of each unique ID and the corresponding error message.
For context, each 'event' looks similar to this:
'Date (?) name (?) error details'
So I have managed to extract the ID and ErrorID, but there are often multiple events of the same ID as that particular doc gets updated.
My thinking was to get each unique value of ID and then the corresponding ErrorID, but im not sure how will splunk know which particular event of say (ID=123) to use for the ErrorID (note that for say all 5 instances of ID=123, ErrorID would most likely be the same).
Would one way be telling it to use the first instance of ID to display ErrorID?
I have searched through threads but no one has quite as what I need I believe, I think I may need to use 'Dedup' but not entirely how to make it get the corresponding ErrorID
Cheers everyone - literally any help would be appreciated.
... View more