Deployment Architecture

How do I remove lines containing stack trace?

asalinas
New Member

Hello,

I just started to use Splunk to search and generate reports from logs collected from a Java application.

Sometimes the logs contain errors and the corresponding stack trace.

To generate reports I would like to remove all the lines containing the stack traces.

Because those lines don't start with a timestamp I'm wondering if it is possible to remove all the log lines that don't start with a time stamp.

But if there are other ways to accomplish the same thing I'd appreciate any help.

0 Karma
1 Solution

woodcock
Esteemed Legend

I am assuming that you are OK with the traces being in the events, but for this report, you need to strip them. Try adding this to your existing search (you may need to adjust the RegEx to match your timestamp format):

|  rex mode=sed "s/(?msi)^(?!\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}.\d{3}).*//"

View solution in original post

0 Karma

woodcock
Esteemed Legend

I am assuming that you are OK with the traces being in the events, but for this report, you need to strip them. Try adding this to your existing search (you may need to adjust the RegEx to match your timestamp format):

|  rex mode=sed "s/(?msi)^(?!\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}.\d{3}).*//"

View solution in original post

0 Karma

asalinas
New Member

Wow!! you can use sed in the search box? Thank you woodcock, that does exactly what I wanted.

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Yes, you can use the regex command in your search to kill all records that don't have your particular timestamp format at the beginning. If that was "2019-01-01 12:34:56.789: then it might look like this...

 | regex _raw="^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}.\d{3}.*"

OR

| search match( _raw,"^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}.\d{3}")

You could also simplify the regex a bit, as long as the data isn't going to start with anything that almost resembles a timestamp.

| search match( _raw,"^[-0-9]{10}\s+[0-9:.]{12}")
0 Karma

asalinas
New Member

Hi DalJeanis, Thank you for your help.
A regular expression like that (minus the _raw field) works to process the a logs using something like grep, but it doesn't work on Splunk.
I seems to me Splunk is grouping the line above the stack trace that contains a timestamp and all the stack trace lines (without the timestamp) into one event.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!