Reporting

How to display only the first line of stacktrace from each stacktrace in results

pdpatil007
Engager

We have exception stacktrace in logs and while searching it in splunk, each stacktrace show all the lines from trace. We would like to search and display only the first line of each stacktrace from the searched results. Please suggest how to acheive this?

Thanks in advance !

Tags (1)

bradparks
Explorer

You could also do this

rex field=exception "(?<shortmessage>[^\r\n])" 

which I use with this other bit to get a nice look at "caused by" too:

| rex field=exception "(?<shortmessage>[^\r\n])" | eval shorter_msg=substr(shortmessage,1,180) | rex field=exception "Caused by: (?<caused_by>[^\r\n])" | stats count by level,shortmessage,caused_by | sort count desc
0 Karma

robertlabrie
Path Finder

Since telling someone (and all others who google their way here) to RTFM on REGEX is basically worthless, I thought I'd share a solution which actually worked:

rex field=exception "(?<shortmessage>.*)"

This gets the first line of a stack trace.

lmyrefelt
Builder

In addition to the good advice from chaker ...

If you have the possibility to make changes at the log-source/appender i would recommend to try to cut the output from this one, down from the whole stack trace to just the first line or first few lines ... this will same you money and resource on the splunk side.

Another option would be to set up something like SEDCMD or a transforms to remove the actual data from the events at index-time, this will also save you some money but will cost you resources splunk-wise .

0 Karma

chaker
Contributor

You could extract the first line into a new field using the rex command, and use regular expression to define or identify the end of the line.

http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Rex

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...