create alert

vineela — Wed, 29 Sep 2021 09:53:05 GMT

Hi All,

I have logs in splunk and i need to create field values and create table with the values,present in logs.

example :Caused by: org.apache.kafka.connect.errors.ConnectException: Failed to start new JMS session connection 1: JMSWMQ2013: The security authentication was not valid that was supplied for queue manager 'EVT302' with connection mode 'Client' and host name '10.37.84.12,10.37.100.13(1442)'.

Above one is the example log and i need to extract value under caused by as description and queue manager number and also the hostname.
Can anyone help me on the same.

Thanks in Advance.

Re: create alert

ITWhisperer — Wed, 29 Sep 2021 10:03:41 GMT

| rex "Caused by: (?<cause>([^:]+:){3}).*queue manager '(?<queuemanager>[^']+).*host name '(?<hostname>[^']+)"

topic Re: create alert in Monitoring Splunk

create alert

Re: create alert