topic Re: Could someone help with building this alert? in Alerting

Could someone help with building this alert?

Miky — Thu, 11 Aug 2022 14:45:59 GMT

Hi All,

Can somebody help me start building this alert:

Alert on PW Startup Critical Failure

Alert should trigger if any events with the following error message are seen. The impacted hosts should be listed in the alert email.
Base Search: index=app_v source=*System.log "Instantiation of bean failed; nested exception is org.springwork.beans.BeanInstantiationException: Could not instantiate bean class [iv.ws.report.pw.ipg.cache.SchedulerJob]: Constructor threw exception"
The PW application has not started up successfully following a code deployment or server start.

Re: Could someone help with building this alert?

Taruchit — Fri, 12 Aug 2022 08:39:48 GMT

Hi @Miky,

As I understand you are looking for the below error in Splunk logs: -

Instantiation of bean failed; nested exception is org.springwork.beans.BeanInstantiationException: Could not instantiate bean class [iv.ws.report.pw.ipg.cache.SchedulerJob]: Constructor threw exception

index="app_v" source=*System.log" AND "Instantiation of bean failed;" AND "nested exception is org.springwork.beans.BeanInstantiationException: Could not instantiate bean class [iv.ws.report.pw.ipg.cache.SchedulerJob]: Constructor threw exception" |stats values(host)

Then you can save the result as alert.

Please share if you need more details.

Thank you

Re: Could someone help with building this alert?

Miky — Fri, 12 Aug 2022 13:19:32 GMT

Hi Taruchit,

Thanks for help!

Will this alert trigger if any of the event occur? How can I trigger this in a table format in email with _time host source errormessage.

Thanks,

Re: Could someone help with building this alert?

Taruchit — Fri, 12 Aug 2022 17:35:20 GMT

Hi @Miky,

You can schedule the alert to run every hour and set the time range of your SPL to fetch data for last 60 minutes. Thus, every hour the SPL will check for events that have the error string and will consolidate those events and send an alert notification to you.

You can use |table command to list down all your required fields in the SPL that you need in final result.
And the alert will share you the same. When you configure the alert, it gives you option to publish results in email body as table, to attach a csv file of all events that SPL fetches.

Please share if the above resolves your issue.

Thank you

Re: Could someone help with building this alert?

Miky — Fri, 12 Aug 2022 17:40:40 GMT

Thanks again Taruchit,

So I tried using Table command to display time, host and source, but I'm not getting any result.
Any hint how to do it, please.

Re: Could someone help with building this alert?

Taruchit — Fri, 12 Aug 2022 18:10:10 GMT

Hi @Miky,

Can you please share your SPL here that you used for the alert? You can mask the business specific values like index name, source name, sourcetype and any other relevant details you do not want to share.

I just want to understand your SPL to help you with it.

Thank you

Re: Could someone help with building this alert?

Miky — Fri, 12 Aug 2022 18:19:34 GMT

Index="a" source="b" AND "Instantiation of bean failed;" AND "nested exception is framework"

| stats values(host)
| table _time, host, source

Re: Could someone help with building this alert?

Taruchit — Fri, 12 Aug 2022 18:28:07 GMT

index="a" source="b" AND "Instantiation of bean failed;" AND "nested exception is framework" | stats values(host) AS host BY _time, source | table _time, host, source

Please see if the above gives you the desired results.