topic Re: monitoring php in Getting Data In

monitoring php

jimmyfallon — Thu, 24 Apr 2014 21:11:55 GMT

hey!

i want to monitor php. at the moment i use splunk-6.0.2-196940-x64-release.
so for this goal i did the following steps:
1.start page splunk -->add data
2.hoose a data type -->a file or directory of files
3.consume any file on this splunk server -->next
1. set the path to my php log. -->continue
4.set source type -->log4php
5.how can i create a visualization of php?

thanks in advance!

Re: monitoring php

martin_mueller — Thu, 24 Apr 2014 21:14:24 GMT

Well, what do you want to visualize?

Take a look at http://docs.splunk.com/Documentation/Splunk/6.0.3/SearchTutorial/WelcometotheSearchTutorial for a decent start into basic visualizations.

Re: monitoring php

jimmyfallon — Thu, 24 Apr 2014 21:22:19 GMT

for example a little overview of the errors. so that i can see very quickly which error appears most frequently.

Re: monitoring php

martin_mueller — Thu, 24 Apr 2014 22:20:07 GMT

That depends on what your log events, specifically those with errors, look like.

Re: monitoring php

jimmyfallon — Fri, 25 Apr 2014 05:49:20 GMT

i use this php log: http://php.net/error-log.

Re: monitoring php

martin_mueller — Fri, 25 Apr 2014 07:02:44 GMT

I don't see any sample data there.

Re: monitoring php

jimmyfallon — Fri, 25 Apr 2014 08:32:16 GMT

for example:
[22-Apr-2014 14:45:54 Europe/Berlin] PHP Fatal error: Call to a member function init() on a non-object in C:\Web-Sites\test.com\plugins\core.log\class.AJXP_Logger.php on line 297
[22-Apr-2014 14:37:30 Europe/Berlin] PHP Fatal error: Maximum execution time of 60 seconds exceeded in
C:\Web-Sites\test.com\index.php on line 68

the php log is a simple text document.

Re: monitoring php

martin_mueller — Fri, 25 Apr 2014 08:48:26 GMT

Something like this?

index=your_php_index sourcetype=your_php_sourcetype php fatal error | rex "error:\s*(?<error_message>.+)" | top error_message

Re: monitoring php

jimmyfallon — Fri, 25 Apr 2014 13:25:01 GMT

is that a search query with pipes? at the moment the data of php is indexed. how can i create an visualization? when i open the search button, i see a visualization tab. do i have to configure something inside this tab?

Re: monitoring php

martin_mueller — Fri, 25 Apr 2014 14:39:18 GMT

You really should go through the tutorial, that answers all those questions.

Re: monitoring php

jimmyfallon — Mon, 28 Sep 2020 16:30:47 GMT

yes thats a good idea.i downloaded the tutorial data of splunk and after that, i indexed the data with splunk. then i type in the search field sourcetype=access_* status=200 action=purchase | top categoryId. this command creats a chart. but i don't really unterstand how splunk can create that. the source of this chart is the text document vendor_sales, right?

Re: monitoring php

martin_mueller — Thu, 01 May 2014 21:46:21 GMT

That search uses the access.log files in www1, www2, www3 directories, as referenced by the sourcetype. top counts the most frequently occurring categoryId field values, and those counts are displayed graphically in a chart.