https://community.splunk.com/t5/Splunk-Search/How-to-calculate-what-percentage-of-bytes-are-Java-stacktraces/m-p/110705#M28939 <P>We are currently indexing logs from various Java applications. Does anyone know of some way we can calculate how much of those logs in one index are Java stacktraces, ideally as a percentage of bytes?</P> Thu, 04 Sep 2014 07:03:37 GMT Bohrnag 2014-09-04T07:03:37Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-what-percentage-of-bytes-are-Java-stacktraces/m-p/110705#M28939 <P>We are currently indexing logs from various Java applications. Does anyone know of some way we can calculate how much of those logs in one index are Java stacktraces, ideally as a percentage of bytes?</P> Thu, 04 Sep 2014 07:03:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-what-percentage-of-bytes-are-Java-stacktraces/m-p/110705#M28939 Bohrnag 2014-09-04T07:03:37Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-what-percentage-of-bytes-are-Java-stacktraces/m-p/110706#M28940 <P>Something like this might work for you , it's a bit fuzzy , not based on actual bytes on disk , but gives an approximation of the percentage of the raw event data that is from exceptions.</P> <P>Replace YOURINDEX and YOUREXCEPTIONPATTERN with relevant values for your environment.</P> <PRE><CODE>index=YOURINDEX | eval event_length_all = len(_raw) |eventstats sum(event_length_all) as all_event_length | regex _raw="YOUREXCEPTIONPATTERN" | eval event_length = len(_raw) | eventstats sum(event_length) as exceptions_length | eval percentage_of_events_that_are_exceptions=exceptions_length/all_event_length*100 | table percentage_of_events_that_are_exceptions </CODE></PRE> Thu, 04 Sep 2014 09:53:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-what-percentage-of-bytes-are-Java-stacktraces/m-p/110706#M28940 Damien_Dallimor 2014-09-04T09:53:14Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-what-percentage-of-bytes-are-Java-stacktraces/m-p/110707#M28941 <P>Thanks! I guess I'll need to look into exactly how to define what a Java stacktrace looks like <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Thu, 04 Sep 2014 11:51:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-what-percentage-of-bytes-are-Java-stacktraces/m-p/110707#M28941 Bohrnag 2014-09-04T11:51:09Z