Extract erros from logs

[haist]

Hi,

I'm new to Splunk and I would like to get top errors on a table, but the external API returns a stack tracing making it difficult to work on it.

I'm trying to make a regex that groups those errors by error code "*Return code: [<code>]*"( letting it work with other errors), than count it.

Could you help me, please? 🥺

[gcusello]

Hi @haist,

if you need help in regex creation, you should share some log examples.

If instead you need help in search, you have to follow these steps:

• identify the error conditions (e.g. in ora errors are identified by ORA9999),
• create a new field (code) using the identified regex,
• Use the new field to filter your logs to have only the error logs,
• identify the relevant fields to display in the table (e.g. host, earliest, latest),
• identify eventual aggregation fields (e.g. code),
• create simple search like the following:

index=your_index code IN ("error1","error2","error3")
| stats values(host) AS host earliest(_time) AS earliest latest(_time) AS latest count BY code
| eval 
   earliest=strftime(earliest,"%Y-%m-%d %H:%M:%S"),
   latest=strftime(latest,"%Y-%m-%d %H:%M:%S")

 Ciao.

Giuseppe

[haist · Accepted solution]

Hi @gcusello, thanks for the suggestion

I used Rex to create a new field with return code, then stats to count and show similar errors

...
| rex field=Response.body.Result "(?<code>(Return code: \[\d+]|null))"
| stats first(Response.body.Result) as Logs count(code) as Events
| table Logs, Events

[gcusello]

Hi @haist,

ok, I don't understand where you are taking the field "counter" that it's in teh table command but it isn't in the stats command.

Remember that after a stats command you have only the fields expressed in the stats command, in your case only "Logs" and "Events", not "counter"!

Anyway, if my answer solves your problem, please accept it for the other people of Community, otherwise, tell me how can I help you.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉

[haist]

That's true, I was generalizing and translating the names and mismatched here, thanks for attention 😀