topic matching different types of exception in Splunk Search

matching different types of exception

prad18 — Wed, 23 Oct 2013 10:56:09 GMT

Hi,

I've to match 3 to 4 types of different types of exception and then tag them as Type_exception.

sample log :

09 Sep 2013 12:25:45,222 [ExecuteThread: '22' for queue: 'default'] ERROR - Remote Exception Exceptionjava.rmi.RemoteException: EJB Exception: ; nested exception is:
java.lang.NullPointerException
Start server side stack trace:
java.rmi.RemoteException: EJB Exception: ; nested exception is:
java.lang.NullPointerException

09 Sep 2013 18:04:00,438 [ExecuteThread: '28' for queue: 'default'] ERROR - Exception Exceptionjava.lang.NullPointerException <>
java.lang.NullPointerException

09 Sep 2013 11:01:37,000 [ExecuteThread: '22' for queue: 'default'] ERROR - Exception Exceptionjava.lang.IllegalStateException: HttpSession is invalid <>
java.lang.IllegalStateException: HttpSession is invalid

How to match exception like remoteexception, NullPointerException, IllegalStateException?

There may be other exception too!.
Do we've to write separate regex for each different exception?

Is other any other way?
Finall we're trying to plot chart showing these many different types exception occurred at different times?
Is this possible?

Re: matching different types of exception

kristian_kolb — Wed, 23 Oct 2013 14:24:01 GMT

Given the limited amount of events you provide, the following will extract the exceptions;

in props.conf

[your_sourcetype_here]
EXTRACT-java_exceptions = Exceptionjava\.[a-z]+\.(?<exception>\S+)

Then you can define an eventtype based on the following search;

sourcetype=your_sourcetype exception=*

http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Classifyandgroupsimilarevents#Save_a_search_as_a_new_event_type

After that you can search for eventtype=javaexception (or whatever you called your eventtype in the previous step).

Hope this helps,

Re: matching different types of exception

prad18 — Thu, 24 Oct 2013 10:52:25 GMT

Kristian,
I'm not expert in regular exp but can we match
1. xx.xxx.xxx.exceptionname
2. xxx.exceptionname
3. xxxxx.exceptionname

all these with single regular expression?

Re: matching different types of exception

kristian_kolb — Tue, 29 Oct 2013 20:12:17 GMT

yes you can.

Maybe something like;
\s(?:[^.]+\.)+(?<exception>\S+)\s

which reads; space, one or more non-dot characters followed by a dot, one or more times, followed by one or more non-space characters (this is what we extract as a field), followed by space.

sorry for the delay in responding.