splunk 检查消息是否包含特定字符串
splunk check if message contains certain string
在 Splunk 搜索查询中如何检查日志消息是否包含文本?
日志消息:
message: 2018-09-21T07:15:28,458+0000 comp=hub-lora-ingestor-0 [vert.x-eventloop-thread-0] INFO com.nsc.iot.hono.receiver.HonoReceiver - Connected successfully, creating telemetry consumer ...
我想检查消息是否包含 "Connected successfully, creating telemetry consumer ..." 并基于此想要将 1 或 0 分配给变量
Splunk 搜索查询
(index="05c48b55-c9aa-4743-aa4b-c0ec618691dd" ("Retry connecting in 1000ms ..." OR "Connect or create consumer failed with exception" OR "Connected successfully, creating telemetry consumer ..."))
| rex field=_raw ^(?:[^ \n]* ){7}(?P<success_status_message>\w+\s+\w+,\s+\w+\s+\w+\s+\w+)"
| timechart count as status | eval status=if(isnull(success_status_message), 0, 1)
success_status_message 始终为空
部分问题在于正则表达式字符串,它与示例数据不匹配。另一个问题是不需要的 timechart
命令,它会过滤掉 'success_status_message' 字段。试试这个搜索:
(index="05c48b55-c9aa-4743-aa4b-c0ec618691dd" ("Retry connecting in 1000ms ..." OR "Connect or create consumer failed with exception" OR "Connected successfully, creating telemetry consumer ..."))
| rex "\s-\s(?P<success_status_message>.*)"
| eval status=if(match(success_status_message, "Connected successfully, creating telemetry consumer"), 1, 0)
在 Splunk 搜索查询中如何检查日志消息是否包含文本?
日志消息:
message: 2018-09-21T07:15:28,458+0000 comp=hub-lora-ingestor-0 [vert.x-eventloop-thread-0] INFO com.nsc.iot.hono.receiver.HonoReceiver - Connected successfully, creating telemetry consumer ...
我想检查消息是否包含 "Connected successfully, creating telemetry consumer ..." 并基于此想要将 1 或 0 分配给变量
Splunk 搜索查询
(index="05c48b55-c9aa-4743-aa4b-c0ec618691dd" ("Retry connecting in 1000ms ..." OR "Connect or create consumer failed with exception" OR "Connected successfully, creating telemetry consumer ..."))
| rex field=_raw ^(?:[^ \n]* ){7}(?P<success_status_message>\w+\s+\w+,\s+\w+\s+\w+\s+\w+)"
| timechart count as status | eval status=if(isnull(success_status_message), 0, 1)
success_status_message 始终为空
部分问题在于正则表达式字符串,它与示例数据不匹配。另一个问题是不需要的 timechart
命令,它会过滤掉 'success_status_message' 字段。试试这个搜索:
(index="05c48b55-c9aa-4743-aa4b-c0ec618691dd" ("Retry connecting in 1000ms ..." OR "Connect or create consumer failed with exception" OR "Connected successfully, creating telemetry consumer ..."))
| rex "\s-\s(?P<success_status_message>.*)"
| eval status=if(match(success_status_message, "Connected successfully, creating telemetry consumer"), 1, 0)