All Apps and Add-ons

Splunk Query for extracting tomcat logs- group by service name

amitru
Engager

I have a log in tomcat as -

 

... [MerchantEndPoint]: saveMerchantDetails():ednpoint execution enterd

..

... [CreditEndPoint]: saveCreditDetails():ednpoint execution enterd

-.. 

 

I want to create a chart based on the entry logs how many times service getting called /day

 

i have created a regex with below query but its not giving correct result, in regex editor it works fine

 

index=fg_wv_li | sourcetype="fg:mylogs.txt" ":endpoint execution started" | rex field=_raw "\b(?<stype>(\[]a-zA-Z]+\][:]))" | chart count by stype

 

i want as servicename:method name : count / day

[MerchantEndPoint]: saveMerchantDetails():    10

[CreditEndPoint]: saveCreditDetails() : 15 

 

Can someone help me to fix the query above?

Thanks.

Labels (2)
0 Karma

renjith_nair
Legend

Try

 

|rex field=_raw "(?<stype>\[\w+\]:\s+\w+\(.*\))"

 

---
What goes around comes around. If it helps, hit it with Karma 🙂

amitru
Engager

Thanks. It worked. 

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...