topic Re: How to Extract the field from Splunk Logs in Dashboards & Visualizations

How to Extract the field from Splunk Logs

aditsss — Wed, 24 Mar 2021 12:13:35 GMT

Hi Everyone,

How can I extract the Below word OutOfMemoryError from the splunk losg

2021-03-24T09:01:32.357185211Z app_name=dgfassetmutation environment=e1 ns=blazepsfsubscribememsql-c2 pod_container=dgfassetmutation pod_name=dgfassetmutation-deployment-3-p24np stream=stdout message=Terminating due to java.lang.OutOfMemoryError: Metaspace

2021-03-03T12:45:30.036179788Z app_name=pulldataoneforce environment=e1 ns=blazepsfpublish pod_container=pulldataoneforce pod_name=pulldataoneforce-deployment-175-kv9tv stream=stdout message=Caused by: java.lang.OutOfMemoryError: unable to create new native thread

Thanks in advance

Re: How to Extract the field from Splunk Logs

manjunathmeti — Wed, 24 Mar 2021 12:21:01 GMT

hi @aditsss,
Try this, highlighted values will be part of field error.

| rex "java\.lang\.(?<error>\w+)\:\s(?<error_msg>[^\n]+)"

If this reply helps you, an upvote/like would be appreciated.

Re: How to Extract the field from Splunk Logs

aditsss — Wed, 24 Mar 2021 13:05:43 GMT

@manjunathmeti

I want to show the complete error message (The highlighted one)

2021-03-24T09:01:32.357185211Z app_name=dgfassetmutation environment=e1 ns=blazepsfsubscribememsql-c2 pod_container=dgfassetmutation pod_name=dgfassetmutation-deployment-3-p24np stream=stdout message=Terminating due to java.lang.OutOfMemoryError: Metaspace

2021-03-03T12:45:30.036179788Z app_name=pulldataoneforce environment=e1 ns=blazepsfpublish pod_container=pulldataoneforce pod_name=pulldataoneforce-deployment-175-kv9tv stream=stdout message=Caused by: java.lang.OutOfMemoryError: unable to create new native thread

How can I extract the complete message

Re: How to Extract the field from Splunk Logs

manjunathmeti — Wed, 24 Mar 2021 13:11:10 GMT

Try this:

| rex "(?<message>message=[^\n]+)"

Re: How to Extract the field from Splunk Logs

aditsss — Wed, 24 Mar 2021 13:36:27 GMT

@manjunathmeti

Its working fine but I want to remove message= part. Currently its coming like this:

message=Caused by: java.lang.NullPointerException: null

I want it to show like this:

Caused by: java.lang.NullPointerException: null

How can I achieve this

Re: How to Extract the field from Splunk Logs

manjunathmeti — Wed, 24 Mar 2021 13:37:52 GMT

You put message= outside group capture.

| rex "message=(?<message>[^\n]+)"