Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Can we find the events which are not matched by Lookup table?

$
0
0
I have a lookup table with which I am categorizing the Error Messages received from a particulat Sourcetype "error". Below is the SPL query that I have used to categorize the Error Messages: sourcetype=error | lookup Error_Wildcards "ErrorMessage" AS "Error Description" output "ErrorType" as "Error Type" | stats count(Robot) as "Number Of Robots with Error" by "Error Type" | table "Error Type", "Number Of Robots with Error" I need to retrieve the Events which are not matched with the Lookup Table and categorize them as "Not Categorized". Is it possible in any way by modifying the Lookup CSV file or by modifying the search query? Please Suggest! Thanks Maria Arokiaraj

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>