Hi Everyone,
How can I extract the below word from the splunk(Null Pointer Exception) logs:
2021-03-19T06:53:54.98455654Z app_name=data-graph-acct environment=e1 ns=sidh-datagraph3 pod_container=data-graph-acct pod_name=data-graph-acct-deployment-257-4w2f5 stream=stdout message=Caused by: java.lang.NullPointerException: null
2021-03-19T06:53:54.984026525Z app_name=data-graph-acct environment=e1 ns=sidh-datagraph3 pod_container=data-graph-acct pod_name=data-graph-acct-deployment-257-4w2f5 stream=stdout message=org.springframework.web.util.NestedServletException: Request processing failed; nested exception is java.lang.NullPointerException
2021-03-19T06:53:54.983956753Z app_name=data-graph-acct environment=e1 ns=sidh-datagraph3 pod_container=data-graph-acct pod_name=data-graph-acct-deployment-257-4w2f5 stream=stdout message=2021-03-18 23:53:54.983 ERROR [dgfaccountnode,bb8854c76341f426,bb8854c76341f426,true] 67 --- [nio-8443-exec-9] c.a.s.d.a.filter.AccountNodeFilter : dgfAccountNodeException=Request processing failed; nested exception is java.lang.NullPointerException
Can someone guide me how to extract NullPointerException word from splunk logs
Hi @aditsss,
If you want to get the error reason you can try below regex;
| rex "java\.lang\.(?<error>[^\s:]+)"
Hi @aditsss,
let me understand what you mean with "extract word":
do you want to search events where there's this word or do you want to put it in a field?
if the first it's immediate, you have only to insert the "NullPointerException" word in your main search.
If instead you want to extract a field containing this word, you have to use a simple regex
| rex "(?<your_field>NullPointerException)
and you'll have a new field containing ths word.
ciao.
Giuseppe
I want to show the complete Error Message for the below logs
2021-03-19T06:53:54.98455654Z app_name=data-graph-acct environment=e1 ns=sidh-datagraph3 pod_container=data-graph-acct pod_name=data-graph-acct-deployment-257-4w2f5 stream=stdout message=Caused by: java.lang.NullPointerException: null
2021-03-19T06:53:54.984026525Z app_name=data-graph-acct environment=e1 ns=sidh-datagraph3 pod_container=data-graph-acct pod_name=data-graph-acct-deployment-257-4w2f5 stream=stdout message=org.springframework.web.util.NestedServletException: Request processing failed; nested exception is java.lang.NullPointerException
2021-03-19T06:53:54.983956753Z app_name=data-graph-acct environment=e1 ns=sidh-datagraph3 pod_container=data-graph-acct pod_name=data-graph-acct-deployment-257-4w2f5 stream=stdout message=2021-03-18 23:53:54.983 ERROR [dgfaccountnode,bb8854c76341f426,bb8854c76341f426,true] 67 --- [nio-8443-exec-9] c.a.s.d.a.filter.AccountNodeFilter : dgfAccountNodeException=Request processing failed; nested exception is java.lang.NullPointerException
The one keyword is NullPointerException.
How can I show the complete Error Message
Hi @aditsss,
please try the below regex:
| rex "message\=(?<message>.*NullPointerException)"
Ciao.
Giuseppe