All Apps and Add-ons

Splunk Query for extracting tomcat logs- group by service name

amitru
Engager

I have a log in tomcat as -

 

... [MerchantEndPoint]: saveMerchantDetails():ednpoint execution enterd

..

... [CreditEndPoint]: saveCreditDetails():ednpoint execution enterd

-.. 

 

I want to create a chart based on the entry logs how many times service getting called /day

 

i have created a regex with below query but its not giving correct result, in regex editor it works fine

 

index=fg_wv_li | sourcetype="fg:mylogs.txt" ":endpoint execution started" | rex field=_raw "\b(?<stype>(\[]a-zA-Z]+\][:]))" | chart count by stype

 

i want as servicename:method name : count / day

[MerchantEndPoint]: saveMerchantDetails():    10

[CreditEndPoint]: saveCreditDetails() : 15 

 

Can someone help me to fix the query above?

Thanks.

Labels (2)
0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Try

 

|rex field=_raw "(?<stype>\[\w+\]:\s+\w+\(.*\))"

 

amitru
Engager

Thanks. It worked. 

0 Karma