Splunk Dev

How can we get the java exception as one event?

ddrillic
Ultra Champion

We have data that looks like -

2017-08-01 13:32:05,079 INFO  [stdout] (ajp-/0.0.0.0:8009-35) LogData[
2017-08-01 13:32:05,079 INFO  [stdout] (ajp-/0.0.0.0:8009-35)   className=UserValidationAppService
2017-08-01 13:32:05,080 INFO  [stdout] (ajp-/0.0.0.0:8009-35)   methodName=UserValidationAppService.validateUser(..)
2017-08-01 13:32:05,080 INFO  [stdout] (ajp-/0.0.0.0:8009-35)   corrId=fbc6c881-1b0b-43c7-83da-07342bc8934d
2017-08-01 13:32:05,080 INFO  [stdout] (ajp-/0.0.0.0:8009-35)   userId=3f499bb6-6838-4c08-badc-c2e13a313901
2017-08-01 13:32:05,080 INFO  [stdout] (ajp-/0.0.0.0:8009-35)   argsArray=[ "3f499bb6-6838-4c08-badc-c2e13a313901", "user", false ]
2017-08-01 13:32:05,080 INFO  [stdout] (ajp-/0.0.0.0:8009-35)   methodEntryTime=2017-08-01T13:32:04.868-05:00
2017-08-01 13:32:05,080 INFO  [stdout] (ajp-/0.0.0.0:8009-35)   methodExitTime=2017-08-01T13:32:05.077-05:00
2017-08-01 13:32:05,080 INFO  [stdout] (ajp-/0.0.0.0:8009-35)   throwable=
2017-08-01 13:32:05,080 INFO  [stdout] (ajp-/0.0.0.0:8009-35) com.xxxxxx.common.exception.ServiceRuntimeException: An error occured while ....
......

2017-08-01 13:32:05,096 INFO  [stdout] (ajp-/0.0.0.0:8009-35)   at java.util.concurrent.FutureTask.run(FutureTask.java:262)
2017-08-01 13:32:05,096 INFO  [stdout] (ajp-/0.0.0.0:8009-35)   at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
2017-08-01 13:32:05,096 INFO  [stdout] (ajp-/0.0.0.0:8009-35)   at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
2017-08-01 13:32:05,096 INFO  [stdout] (ajp-/0.0.0.0:8009-35)   ... 1 more
2017-08-01 13:32:05,096 INFO  [stdout] (ajp-/0.0.0.0:8009-35)
2017-08-01 13:32:05,096 INFO  [stdout] (ajp-/0.0.0.0:8009-35) ]

How can we extract the event to be everything the LogData contains between the square brackets with various fields including throwable which can be fairly large?

Tags (1)
0 Karma

mwirth_splunk
Splunk Employee
Splunk Employee

I'm assuming that there are events that truly are only one line mixed with these exception dumps?

I'd recommend looking into "MUST_BREAK_AFTER" and "MUST_NOT_BREAK_AFTER" in props.conf
So you'd end up with something like;

MUST_BREAK_AFTER= \]
MUST_NOT_BREAK_AFTER=\d{4}\-\d{2}\-\d{2}\s\d{2}\:\d{2}\:\d{2}\,\d{3}\s.+?LogData\[

The idea here is that Splunk will continue to linebreak each line unless it detects that "LogData[" string, at which point it will stop linebreaking until it encounters the close bracket. Hopefully this will make one event out of many.

0 Karma

ddrillic
Ultra Champion

Perfect @mwirth - I'll try it...

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...