topic Re: How to generate a table that lists all Java exceptions? in Splunk Search

How to generate a table that lists all Java exceptions?

jw44250 — Thu, 05 Jan 2017 16:44:41 GMT

I want to List all exceptions (java, spring, hibernate, etc) such as sql, unchecked, checkException plus any framework exception from a log in nice table format.

Re: How to generate a table that lists all Java exceptions?

hunters_splunk — Thu, 05 Jan 2017 17:43:54 GMT

Hi jw44250, could you please share a bit more info about your log, some sample data maybe? Thanks!

Re: How to generate a table that lists all Java exceptions?

jw44250 — Thu, 05 Jan 2017 18:26:17 GMT

This is my logs
2012-08-10 08:19:17 [SEVERE] java.lang.NullPointerException
2012-08-10 08:19:17 [SEVERE] at net.minecraft.server.World.tickEntities(World.java:1146)
2012-08-10 08:19:17 [SEVERE] at net.minecraft.server.MinecraftServer.q(MinecraftServer.java:567)
2012-08-10 08:19:17 [SEVERE] at net.minecraft.server.DedicatedServer.q(DedicatedServer.java:212)
2012-08-10 08:19:17 [SEVERE] at net.minecraft.server.MinecraftServer.p(MinecraftServer.java:476)
2012-08-10 08:19:17 [SEVERE] at net.minecraft.server.MinecraftServer.run(MinecraftServer.java:408)
2012-08-10 08:19:17 [SEVERE] at net.minecraft.server.ThreadServerApplication.run(SourceFile:539)
java.lang.NullPointerException

Re: How to generate a table that lists all Java exceptions?

jw44250 — Thu, 05 Jan 2017 18:28:48 GMT

Output
ExceptionName Total Occureence of Exception
AllTotalException . 60

Another Output
ExceptionName Total Occureence of Exception
.....SQLException . 10
.....NullPointerException . 5
..........................XException . 1

Re: How to generate a table that lists all Java exceptions?

gokadroid — Thu, 05 Jan 2017 19:06:02 GMT

Answer to this question depends on how well you know the strings which come in log when the exception occur. For the lines of your log posted above we can do something like:

your query to return events
| rex field=_raw "\[SEVERE\](\s|\sat\s)(?<myException>[^\s\(]+)"
| stats count by myException

A similar scenario we handled in our projects was to target only the Caused by: line from the entire stack trace. Error logs we had were:

Caused by: org.apache.xerces.impl.io.MalformedByteSequenceException: Invalid byte 2 of 2-byte UTF-8 sequence.
        at org.apache.xerces.parsers.DOMParser.parse(Unknown Source)
        at org.apache.xerces.jaxp.DocumentBuilderImpl.parse(Unknown Source)
        at javax.xml.parsers.DocumentBuilder.parse(DocumentBuilder.java:124)
        at com.citigroup.ebusiness.jfp.messaging.tibco.common.util.DOMUtils.parseXmlString(DOMUtils.java:166)
        ... 8 more

Query to fetch these were written as:

index=myIndex sourcetype=mySourcetype "Caused by:"
| rex field=_raw "Caused by:\s(?<myException>[\S]+)"
| stats count by myException

You can build upon it similarly.

Re: How to generate a table that lists all Java exceptions?

jw44250 — Thu, 05 Jan 2017 20:17:16 GMT

i have account all the exceptions from 5apps and their logs

Field 1 . field . total Occurenance
Error . xyz . 3
Exception . NPE . 2

Re: How to generate a table that lists all Java exceptions?

jw44250 — Thu, 05 Jan 2017 20:19:51 GMT

thanks -- why selection "Caused by: " --

im totally new to splunk

Re: How to generate a table that lists all Java exceptions?

gokadroid — Fri, 06 Jan 2017 00:11:27 GMT

That's because in our use case we were only interested in the lines having "Caused by:" from the entire stack trace; which is the actual cause of error and there might be a lot of errors/subExceptions in the stack trace:

 index=myIndex sourcetype=mySourcetype "Caused by:"
 | rex field=_raw "Caused by:\s(?<myException>[\S]+)"
 | stats count by myException

Your log lines which you posted should work out with this query I posted initially if that's how the errors occur in your logs:

 your query to return events
 | rex field=_raw "\[SEVERE\](\s|\sat\s)(?<myException>[^\s\(]+)"
 | stats count by myException

Re: How to generate a table that lists all Java exceptions?

jw44250 — Fri, 06 Jan 2017 01:50:23 GMT

thnks a lot for your help

Re: How to generate a table that lists all Java exceptions?

jw44250 — Tue, 29 Sep 2020 12:25:45 GMT

my result still not prefect ...i end up doing this :

My output is all over the places....currently try to figure the expected output since rows and columns is merges.

the above query cause me issue regarding exceptions becuase the same exception (NPE) can appear in index 1 /2 or both -- getting different wrong result -- i needed to range colns order (A, B ) . (B, A)

Re: How to generate a table that lists all Java exceptions?

gokadroid — Fri, 06 Jan 2017 04:44:33 GMT

Try

(index=index1 OR index=index2) (sourcetype=sourcetype1 OR sourcetype=sourcetype2)
| complete the query

Re: How to generate a table that lists all Java exceptions?

jw44250 — Fri, 06 Jan 2017 05:00:43 GMT

suppose having 10 of logs files coming from 10 different applications. find total exceptions for each logs and output should look:

AppList . IndexList ExceptionName Occurance . Time
App1 index 1 java....NullPointerException . 10 7:00am
App2 index 2 java....SQLException . . 10 9:00pm

comments: (index=index1 OR index=index2) . need to use AND --- (matching is needed)

Re: How to generate a table that lists all Java exceptions?

jw44250 — Mon, 09 Jan 2017 16:45:14 GMT

how to combine and arrang two different fields

input is like this :

field1 . field2
10 . 20

output
Final Field
10
20