Hi All,
Can somebody help me start building this alert:
Alert on PW Startup Critical Failure
index="a" source="b" AND "Instantiation of bean failed;" AND "nested exception is framework"
| stats values(host) AS host BY _time, source
| table _time, host, source
Please see if the above gives you the desired results.
Hi @Miky,
As I understand you are looking for the below error in Splunk logs: -
Instantiation of bean failed; nested exception is org.springwork.beans.BeanInstantiationException: Could not instantiate bean class [iv.ws.report.pw.ipg.cache.SchedulerJob]: Constructor threw exception
index="app_v" source=*System.log" AND "Instantiation of bean failed;" AND "nested exception is org.springwork.beans.BeanInstantiationException: Could not instantiate bean class [iv.ws.report.pw.ipg.cache.SchedulerJob]: Constructor threw exception"
|stats values(host)
Then you can save the result as alert.
Please share if you need more details.
Thank you
Hi Taruchit,
Thanks for help!
Will this alert trigger if any of the event occur? How can I trigger this in a table format in email with _time host source errormessage.
Thanks,
Hi @Miky,
You can schedule the alert to run every hour and set the time range of your SPL to fetch data for last 60 minutes. Thus, every hour the SPL will check for events that have the error string and will consolidate those events and send an alert notification to you.
You can use |table command to list down all your required fields in the SPL that you need in final result.
And the alert will share you the same. When you configure the alert, it gives you option to publish results in email body as table, to attach a csv file of all events that SPL fetches.
Please share if the above resolves your issue.
Thank you
Thanks again Taruchit,
So I tried using Table command to display time, host and source, but I'm not getting any result.
Any hint how to do it, please.
Hi @Miky,
Can you please share your SPL here that you used for the alert? You can mask the business specific values like index name, source name, sourcetype and any other relevant details you do not want to share.
I just want to understand your SPL to help you with it.
Thank you
Index="a" source="b" AND "Instantiation of bean failed;" AND "nested exception is framework"
| stats values(host)
| table _time, host, source
index="a" source="b" AND "Instantiation of bean failed;" AND "nested exception is framework"
| stats values(host) AS host BY _time, source
| table _time, host, source
Please see if the above gives you the desired results.