Reporting

How to display only the first line of stacktrace from each stacktrace in results

pdpatil007
Engager

We have exception stacktrace in logs and while searching it in splunk, each stacktrace show all the lines from trace. We would like to search and display only the first line of each stacktrace from the searched results. Please suggest how to acheive this?

Thanks in advance !

Tags (1)

bradparks
Explorer

You could also do this

rex field=exception "(?<shortmessage>[^\r\n])" 

which I use with this other bit to get a nice look at "caused by" too:

| rex field=exception "(?<shortmessage>[^\r\n])" | eval shorter_msg=substr(shortmessage,1,180) | rex field=exception "Caused by: (?<caused_by>[^\r\n])" | stats count by level,shortmessage,caused_by | sort count desc
0 Karma

robertlabrie
Path Finder

Since telling someone (and all others who google their way here) to RTFM on REGEX is basically worthless, I thought I'd share a solution which actually worked:

rex field=exception "(?<shortmessage>.*)"

This gets the first line of a stack trace.

lmyrefelt
Builder

In addition to the good advice from chaker ...

If you have the possibility to make changes at the log-source/appender i would recommend to try to cut the output from this one, down from the whole stack trace to just the first line or first few lines ... this will same you money and resource on the splunk side.

Another option would be to set up something like SEDCMD or a transforms to remove the actual data from the events at index-time, this will also save you some money but will cost you resources splunk-wise .

0 Karma

chaker
Contributor

You could extract the first line into a new field using the rex command, and use regular expression to define or identify the end of the line.

http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Rex

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...