topic Re: Help with field extraction and table in Splunk Search

Help with field extraction and table

splunknoob — Fri, 24 Jul 2020 12:09:01 GMT

I hope someone can help me .. I am completely new to Splunk. Although I love it so far I don't really know how to use it.

I want to filter for events only containing mongodbX and Couldn't get a connection.

The event can have mongodb1 or mongodb2 or mongodb3 as in example.

And use the filtered events to build a graph.

Example event:

{"time":"2020-07-24T11:48:21.18957143Z","event":"2020-07-24T11:48:21.189+0000 I REPL_HB [replexec-949] Error in heartbeat (requestId: 649360) to mongodb3:27017, response status: NetworkInterfaceExceededTimeLimit: Couldn't get a connection within the time limit\n","hostname":"node2"}

Thank you

Re: Help with field extraction and table

gcusello — Fri, 24 Jul 2020 12:17:44 GMT

Hi @splunknoob,

at first follow the Splunk Free corses (https://www.splunk.com/en_us/training/free-courses/splunk-fundamentals-1.html) and The Splunk search Tutorial (https://docs.splunk.com/Documentation/Splunk/8.0.5/SearchTutorial/WelcometotheSearchTutorial).

Anyway, you have two ways to search in Splunk:

full text search: in other words, using Splunk as Google search inserting the words to search;
structured search: extract fields and search on fields, it's faster than the other but it requests more work.

In your sample you can use the first:

index=your_index mongodb* "Couldn't get a connection" | ...

Ciao.

Giuseppe

Re: Help with field extraction and table

splunknoob — Fri, 24 Jul 2020 12:43:30 GMT

Hi @gcusello

Thanks a lot for your reply and help. Really appreciate it.

I will definitely take the fundamentals course.

Your suggestion works and I only see events with what I need.

----

Could someone please help me with next part?

I need to build a graph when mongodb1 or 2 or 3 goes down.

Thank you

Re: Help with field extraction and table

gcusello — Fri, 24 Jul 2020 13:08:11 GMT

Hi @splunknoob,

try something like this:

index=your_index mongodb* "Couldn't get a connection" | rex "Error\s+in\s+heartbeat\s+\(requestId:\s+\d+\)\s+to\s+(?<mongo>[^:]+)" | timechart count BY mongo

in this way you can trace all the downs of your systems divided by mongodb.

If you want to check the regex see at https://regex101.com/r/y67Fa0/1

Ciao.

Giuseppe