I have a lookup table with which I am categorizing the Error Messages received from a particulat Sourcetype "error".
Below is the SPL query that I have used to categorize the Error Messages:
sourcetype=error
| lookup Error_Wildcards "ErrorMessage" AS "Error Description" output "ErrorType" as "Error Type"
| stats count(Robot) as "Number Of Robots with Error" by "Error Type"
| table "Error Type", "Number Of Robots with Error"
I need to retrieve the Events which are not matched with the Lookup Table and categorize them as "Not Categorized".
Is it possible in any way by modifying the Lookup CSV file or by modifying the search query? Please Suggest!
Thanks
Maria Arokiaraj
↧