How to display only the first line of stacktrace from each stacktrace in results


We have exception stacktrace in logs and while searching it in splunk, each stacktrace show all the lines from trace. We would like to search and display only the first line of each stacktrace from the searched results. Please suggest how to acheive this?

Thanks in advance !

Tags (1)


You could also do this

rex field=exception "(?<shortmessage>[^\r\n])" 

which I use with this other bit to get a nice look at "caused by" too:

| rex field=exception "(?<shortmessage>[^\r\n])" | eval shorter_msg=substr(shortmessage,1,180) | rex field=exception "Caused by: (?<caused_by>[^\r\n])" | stats count by level,shortmessage,caused_by | sort count desc
0 Karma

Path Finder

Since telling someone (and all others who google their way here) to RTFM on REGEX is basically worthless, I thought I'd share a solution which actually worked:

rex field=exception "(?<shortmessage>.*)"

This gets the first line of a stack trace.


In addition to the good advice from chaker ...

If you have the possibility to make changes at the log-source/appender i would recommend to try to cut the output from this one, down from the whole stack trace to just the first line or first few lines ... this will same you money and resource on the splunk side.

Another option would be to set up something like SEDCMD or a transforms to remove the actual data from the events at index-time, this will also save you some money but will cost you resources splunk-wise .

0 Karma

Path Finder

You could extract the first line into a new field using the rex command, and use regular expression to define or identify the end of the line.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...