https://community.splunk.com/t5/Splunk-Search/How-to-display-the-output-for-tomcat-logs-with-starttime-and/m-p/192397#M55317 <P>What does your input look like?</P> Mon, 23 Mar 2015 16:48:37 GMT richgalloway 2015-03-23T16:48:37Z https://community.splunk.com/t5/Splunk-Search/How-to-display-the-output-for-tomcat-logs-with-starttime-and/m-p/192396#M55316 <P>Hi,<BR /> For query</P> <PRE><CODE>(SEVERE OR exception OR CRITICAL OR "[error]")|rex field=_raw "(?^\d\d-\w\w\w-\d\d\d\d\s\d\d:\d\d:\d\d.\d\d\d)\s(?.*)"|stats count(detail) as ct by detail </CODE></PRE> <P>I get the following:</P> <PRE><CODE>detail ct SEVERE [tomcat-http--38] org.apache.catalina.core.ApplicationDispatcher.invoke Servlet.service() for servlet jsp threw exception 11 SEVERE [tomcat-http--47] org.apache.catalina.core.ApplicationDispatcher.invoke Servlet.service() for servlet jsp threw exception 6 </CODE></PRE> <P>Now I want to include the start mtime and end mtime in the output so that I can see something like following:</P> <PRE><CODE>SEVERE [tomcat-http--38] org.apache.catalina.core.ApplicationDispatcher.invoke Servlet.service() for servlet jsp threw exception 11 starttime endtime of the 11 events SEVERE [tomcat-http--47] org.apache.catalina.core.ApplicationDispatcher.invoke Servlet.service() for servlet jsp threw exception 6 starttime of the 6 events endtime of the 6 events SEVERE [tomcat-http--20] org.apache.catalina.core.ApplicationDispatcher.invoke Servlet.service() for servlet jsp threw exception 1 starttime endtime (where both starttime = endtime because only 1 event) </CODE></PRE> <P>Tried with <CODE>eventstats min(mtime) and max(mtime)</CODE>, but getting min of mtime of all the 18 events. Running out of ideas.<BR /> could someone advise me how to achieve this? </P> <P>Thanks.</P> Mon, 23 Mar 2015 16:02:49 GMT https://community.splunk.com/t5/Splunk-Search/How-to-display-the-output-for-tomcat-logs-with-starttime-and/m-p/192396#M55316 lim2 2015-03-23T16:02:49Z https://community.splunk.com/t5/Splunk-Search/How-to-display-the-output-for-tomcat-logs-with-starttime-and/m-p/192397#M55317 <P>What does your input look like?</P> Mon, 23 Mar 2015 16:48:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-display-the-output-for-tomcat-logs-with-starttime-and/m-p/192397#M55317 richgalloway 2015-03-23T16:48:37Z https://community.splunk.com/t5/Splunk-Search/How-to-display-the-output-for-tomcat-logs-with-starttime-and/m-p/192398#M55318 <P>(SEVERE OR exception OR CRITICAL OR "[error]")|rex field=_raw "(?^\d\d-\w\w\w-\d\d\d\d\s\d\d:\d\d:\d\d.\d\d\d)\s(?.*)"| transaction detail|eval startt=min(mtime)|eval endt=max(mtime)|stats count(detail) by detail, source, host, startt, endt<BR /> The above query is giving me the right starttime and endtime<BR /> But count(detail) is always 1.<BR /> How to get ct of events in each transaction, 5 events ? like in <A href="http://docs.splunk.com/File:TransactionEx3_eventsList.png" target="_blank">http://docs.splunk.com/File:TransactionEx3_eventsList.png</A> </P> <P>23-Mar-2015 10:28:22.299 SEVERE [tomcat-http--38] org.apache.catalina.core.StandardHostValve.custom Exception Processing ErrorPage[exceptionType=java.lang.Throwable, location=/error.jsp] ... 77 lines omitted ... <BR /> 23-Mar-2015 10:28:37.566 SEVERE [tomcat-http--38] org.apache.catalina.core.StandardHostValve.custom Exception Processing ErrorPage[exceptionType=java.lang.Throwable, location=/error.jsp] ... 38 lines omitted ... <BR /> 23-Mar-2015 10:28:50.962 SEVERE [tomcat-http--38] org.apache.catalina.core.StandardHostValve.custom Exception Processing ErrorPage[exceptionType=java.lang.Throwable, location=/error.jsp] ... 38 lines omitted ... <BR /> 23-Mar-2015 10:30:31.844 SEVERE [tomcat-http--38] org.apache.catalina.core.StandardHostValve.custom Exception Processing ErrorPage[exceptionType=java.lang.Throwable, location=/error.jsp] ... 38 lines omitted ... <BR /> 23-Mar-2015 10:31:04.643 SEVERE [tomcat-http--38] org.apache.catalina.core.StandardHostValve.custom Exception Processing ErrorPage[exceptionType=java.lang.Throwable, location=/error.jsp]</P> Mon, 28 Sep 2020 19:18:35 GMT https://community.splunk.com/t5/Splunk-Search/How-to-display-the-output-for-tomcat-logs-with-starttime-and/m-p/192398#M55318 lim2 2020-09-28T19:18:35Z https://community.splunk.com/t5/Splunk-Search/How-to-display-the-output-for-tomcat-logs-with-starttime-and/m-p/192399#M55319 <P>(SEVERE OR exception OR CRITICAL OR "[error]")|rex field=_raw "(?^dd-www-ddddsdd:dd:dd.ddd)s(?.*)"| transaction detail|eval startt=min(mtime)|eval endt=max(mtime)|table detail, source, host, startt, endt, eventcount</P> Sun, 29 Mar 2015 01:08:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-display-the-output-for-tomcat-logs-with-starttime-and/m-p/192399#M55319 lim2 2015-03-29T01:08:07Z https://community.splunk.com/t5/Splunk-Search/How-to-display-the-output-for-tomcat-logs-with-starttime-and/m-p/192400#M55320 <P>Hi @lim2</P> <P>You put this search in the Answer section, but didn't include any context what this was for. Did this search solve your question?</P> Mon, 30 Mar 2015 20:21:49 GMT https://community.splunk.com/t5/Splunk-Search/How-to-display-the-output-for-tomcat-logs-with-starttime-and/m-p/192400#M55320 ppablo 2015-03-30T20:21:49Z