topic Re: Group Java Exceptions, even though there is no KV pair in Splunk Search

Group Java Exceptions, even though there is no KV pair

seanlon11 — Thu, 09 Dec 2010 06:17:06 GMT

I have all types of Java Exceptions within my logs, that have no real form to them, except that they all start with "com." or "java." and end with exactly ".Exception".

For example:

java.lang.IllegalStateException
java.lang.NullPointerException
javax.servlet.ServletException
com.ibm.blah.SomeException
etc.

How can I extract this in-line?

Thanks, Sean

Re: Group Java Exceptions, even though there is no KV pair

southeringtonp — Thu, 09 Dec 2010 07:41:08 GMT

If you want it purely inline, try:

| rex field=_raw "\b(?<exception_type>(com|java|javax)\.[\w\.]+Exception)"

(Match on either "com" or "java" or javax, followed by a dot, and then as many word characters or dots as you need until you finish with "Exception")

If you'd rather not have to use it in the search string, then:

In transforms.conf:

[exception-type]
REGEX  = \b((com|java|javax)\.[\w\.]+Exception)\b
FORMAT = exception_type::$1

In props.conf:

[yoursourcetype]
REPORT-exceptions = exception-type

Or, you can configure an eventtype for each exception type or group of exception types.

Re: Group Java Exceptions, even though there is no KV pair

seanlon11 — Mon, 28 Sep 2020 09:21:56 GMT

How do I then reference these fields? I tried the following, but it did not work.

eventtype="all_web" *Exception | rex field=_raw ".(?(com|java).[\w.]+Exception)" | stats count(exception_type) by host

Thanks for the help!

Re: Group Java Exceptions, even though there is no KV pair

tedder — Thu, 16 Dec 2010 07:33:18 GMT

I think you have a simple typo. Taking part of your query:
".(?(com|java).[\w.]+Exception)"
try this:
".(<?exception_type>(com|java).[\w.]+Exception)"

Re: Group Java Exceptions, even though there is no KV pair

southeringtonp — Thu, 16 Dec 2010 22:03:11 GMT

You're right that it was a typo, but the question mark was in the right place. The leading dot should have been a word breaker ('.' vs '\b'). Edited above to correct.