Archive
Highlighted

How to display only the first line of stacktrace from each stacktrace in results

Engager

We have exception stacktrace in logs and while searching it in splunk, each stacktrace show all the lines from trace. We would like to search and display only the first line of each stacktrace from the searched results. Please suggest how to acheive this?

Thanks in advance !

Tags (1)
Highlighted

Re: How to display only the first line of stacktrace from each stacktrace in results

Path Finder

You could extract the first line into a new field using the rex command, and use regular expression to define or identify the end of the line.

http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Rex

0 Karma
Highlighted

Re: How to display only the first line of stacktrace from each stacktrace in results

Builder

In addition to the good advice from chaker ...

If you have the possibility to make changes at the log-source/appender i would recommend to try to cut the output from this one, down from the whole stack trace to just the first line or first few lines ... this will same you money and resource on the splunk side.

Another option would be to set up something like SEDCMD or a transforms to remove the actual data from the events at index-time, this will also save you some money but will cost you resources splunk-wise .

0 Karma
Highlighted

Re: How to display only the first line of stacktrace from each stacktrace in results

Path Finder

Since telling someone (and all others who google their way here) to RTFM on REGEX is basically worthless, I thought I'd share a solution which actually worked:

rex field=exception "(?<shortmessage>.*)"

This gets the first line of a stack trace.

Highlighted

Re: How to display only the first line of stacktrace from each stacktrace in results

Explorer

You could also do this

rex field=exception "(?<shortmessage>[^\r\n])" 

which I use with this other bit to get a nice look at "caused by" too:

| rex field=exception "(?<shortmessage>[^\r\n])" | eval shorter_msg=substr(shortmessage,1,180) | rex field=exception "Caused by: (?<caused_by>[^\r\n])" | stats count by level,shortmessage,caused_by | sort count desc
0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.