topic Re: Extract first 3 lines of raw logs and group in Splunk Search

Extract first 3 lines of raw logs and group

alex5441 — Wed, 31 Mar 2021 04:37:39 GMT

Hi,

My current query for splunk dashboard is as:

........| eval ErrorMsg=_raw | stats count by Application, ErrorMsg | sort -count | table count, Application, ErrorMsg

My able looks like this:

count	Application	ErrorMsg
5	abc	{"severity" : "ERROR", "exception" : "xyz abc asd......."........"time" : "12:00:00"><there are mutiple key value pairs with data in multiple lines>........}
10	abc	{"severity" : "ERROR", "exception" : "xyz abc asd......."........."time" : "12:01:00"<there are mutiple key value pairs with data in multiple lines>........}

How can I get table like this:

abc

"exception" : "xyz abc asd

Re: Extract first 3 lines of raw logs and group

manjunathmeti — Wed, 31 Mar 2021 13:58:47 GMT

hi @alex5441,
You can extract the values for the field ErrorMsg using rex command.

........| rex "(?<ErrorMsg>\"exception\"\s:\s\"\w+\s\w+\w\s\w+)" | stats count by Application, ErrorMsg | sort -count | table count, Application, ErrorMsg

If this reply helps you, a like would be appreciated.

Re: Extract first 3 lines of raw logs and group

alex5441 — Wed, 31 Mar 2021 13:54:54 GMT

Hi @manjunathmeti

Thanks for your reply but Nothing changed on table.

Re: Extract first 3 lines of raw logs and group

manjunathmeti — Wed, 31 Mar 2021 13:59:14 GMT

I updated my answer, check now.

Re: Extract first 3 lines of raw logs and group

alex5441 — Wed, 31 Mar 2021 22:38:52 GMT

Hi manjunathmet,

Nothing changed agian. However I think if I get everything extracted value of exception Key that would suffice my requirement.

{"Severity": "ERROR", "exception":"..................................", "logger":"....................."}

In above pattern I am able to extract with regex: exception":"(.*?)"

But I have to use it as rex in my SPL which needs escaping special chars which I am not sure about.

Re: Extract first 3 lines of raw logs and group

scelikok — Thu, 01 Apr 2021 01:38:21 GMT

Hi @alex5441,

Please try below;

| rex "exception\"\s:\s\"(?<ErrorMsg>.*?)\"" | stats count by Application ErrorMsg | sort -count | table count, Application, ErrorMsg

Re: Extract first 3 lines of raw logs and group

manjunathmeti — Thu, 01 Apr 2021 05:23:37 GMT

Try this:

... | rex "exception\"\s?:\s?\"(?<ErrorMsg>[^\"]+)\"" | stats count by Application, ErrorMsg | sort -count | table count, Application, ErrorMsg