https://community.splunk.com/t5/Reporting/Need-help-in-generating-a-custom-report/m-p/22666#M419 <P>Thanks a lot, i am trying to work on.</P> Tue, 12 Feb 2013 10:52:35 GMT mkumarpisl 2013-02-12T10:52:35Z https://community.splunk.com/t5/Reporting/Need-help-in-generating-a-custom-report/m-p/22664#M417 <P>Hi Everyone,</P> <P>I need to generate a customized report for analysing the error on the application server.</P> <P>My log will be in the format as below.</P> <P>2013.02.06- 13:51:32.186(PST)|0Lbw4V5QmkjbukJtDVxjTA==|hupy123456|Manoj|AccountDetails|mkmpbt51:18|token1: Nullpointerexception while processing the request.</P> <P>The fields in the above log statement is as <BR /> Timestamp | application id | client id | clientname | classname | servername:instance|error details.</P> <P>I want to generate a report with the above information by placing | as delimiter. and i need to get the unique count info of the errors.</P> <P>Can any one guide me on this. Thanks.</P> <P>Thanks,<BR /> Manoj</P> Thu, 07 Feb 2013 08:40:32 GMT https://community.splunk.com/t5/Reporting/Need-help-in-generating-a-custom-report/m-p/22664#M417 mkumarpisl 2013-02-07T08:40:32Z https://community.splunk.com/t5/Reporting/Need-help-in-generating-a-custom-report/m-p/22665#M418 <P>You may need to do some reading on field extractons for this to make much sense. But...</P> <P>In <STRONG>transforms.conf</STRONG></P> <PRE><CODE>[yoursourcetypehere] DELIMS = "|" FIELDS = Timestamp,application_id,client_id,clientname,classname,servername_instance,error_details </CODE></PRE> <P>In your search:</P> <PRE><CODE>sourcetype=yoursourcetypehere | stats count by error_details </CODE></PRE> <P>or however you want to count and report. A few more details about the report would be helpful...</P> <P>Some helpful info about field extractions:<BR /><BR /> <A href="http://docs.splunk.com/Documentation/Splunk/5.0.2/Knowledge/Addfieldsatsearchtime">Add fields at searchtime</A><BR /><BR /> <A href="http://docs.splunk.com/Documentation/Splunk/5.0.2/Knowledge/Createandmaintainsearch-timefieldextractionsthroughconfigurationfiles#Create_advanced_search-time_field_extractions_with_field_transforms">Create advanced field extractions</A></P> Thu, 07 Feb 2013 09:18:26 GMT https://community.splunk.com/t5/Reporting/Need-help-in-generating-a-custom-report/m-p/22665#M418 lguinn2 2013-02-07T09:18:26Z https://community.splunk.com/t5/Reporting/Need-help-in-generating-a-custom-report/m-p/22666#M419 <P>Thanks a lot, i am trying to work on.</P> Tue, 12 Feb 2013 10:52:35 GMT https://community.splunk.com/t5/Reporting/Need-help-in-generating-a-custom-report/m-p/22666#M419 mkumarpisl 2013-02-12T10:52:35Z