Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Splunk Search
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Extract specific fields from unstructured logs
Options
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Nidd
Path Finder
05-02-2021
09:24 PM
I have a list of unstructured logs like below for which I have to extract certain fields. Tried using "Extract fields" option to pull these fields but not receiving the results as expected.
Can someone please help on a way to achieving this through Splunk search query itself?
Fields to be extracted:
2. my-pipeline
3. JDBC_06 - Failed to initialize connection pool: com.zaxxer.hikari.pool.HikariPool$PoolInitializationException: Failed to initialize pool: ORA-01017: invalid username/password; logon denied
Logs:
2021-05-02 11:21:13,663 [user:*[email protected]] [pipeline:my-pipeline (SCH Test Run)/[email protected]] [runner:] [thread:ProductionPipelineRunnable-testRun__12a-23b-34c-45d-56d_site.com__myemail@site.com-my-pipeline (SCH Test Run)] [stage:] ERROR JdbcSource - Cannot connect to specified database: com.streamsets.pipeline.api.StageException: JDBC_06 - Failed to initialize connection pool: com.zaxxer.hikari.pool.HikariPool$PoolInitializationException: Failed to initialize pool: ORA-01017: invalid username/password; logon denied
com.streamsets.pipeline.api.StageException: JDBC_06 - Failed to initialize connection pool: com.zaxxer.hikari.pool.HikariPool$PoolInitializationException: Failed to initialize pool: ORA-01017: invalid username/password; logon denied
2021-03-01 04:18:26,910 [user:*[email protected]] [pipeline:my-pipeline (SCH Test Run)/[email protected]] [runner:] [thread:ProductionPipelineRunnable-testRun__12a-23b-34c-45d-56d_site.com__myemail@site.com-my-pipeline (SCH Test Run)] [stage:] ERROR ProductionPipelineRunnable - An exception occurred while running the pipeline, com.streamsets.datacollector.runner.PipelineRuntimeException: CONTAINER_0800 - Can't start pipeline due 1 validation error(s). First one: JDBC_06 - Failed to initialize connection pool: com.zaxxer.hikari.pool.HikariPool$PoolInitializationException: Failed to initialize pool: Listener refused the connection with the following error:
ORA-12514, TNS:listener does not currently know of service requested in connect descriptor
2021-03-01 04:43:12,985 [user:*[email protected]] [pipeline:my-pipeline (SCH Test Run)/[email protected]] [runner:] [thread:ProductionPipelineRunnable-testRun__12a-23b-34c-45d-56d_site.com__myemail@site.com-my-pipeline (SCH Test Run)] [stage:] ERROR ProductionPipelineRunnable - An exception occurred while running the pipeline, com.streamsets.datacollector.runner.PipelineRuntimeException: CONTAINER_0800 - Can't start pipeline due 1 validation error(s). First one: JDBC_06 - Failed to initialize connection pool: com.zaxxer.hikari.pool.HikariPool$PoolInitializationException: Failed to initialize pool: IO Error: The Network Adapter could not establish the connection
com.streamsets.datacollector.runner.PipelineRuntimeException: CONTAINER_0800 - Can't start pipeline due 1 validation error(s). First one: JDBC_06 - Failed to initialize connection pool: com.zaxxer.hikari.pool.HikariPool$PoolInitializationException: Failed to initialize pool: IO Error: The Network Adapter could not establish the connection
2021-03-01 05:02:13,113 [user:*[email protected]] [pipeline:my-pipeline (SCH Test Run)/[email protected]] [runner:] [thread:ProductionPipelineRunnable-testRun__12a-23b-34c-45d-56d_site.com__myemail@site.com-my-pipeline (SCH Test Run)] [stage:] ERROR ProductionPipelineRunnable - An exception occurred while running the pipeline, com.streamsets.datacollector.runner.PipelineRuntimeException: CONTAINER_0800 - Can't start pipeline due 1 validation error(s). First one: JDBC_06 - Failed to initialize connection pool: com.zaxxer.hikari.pool.HikariPool$PoolInitializationException: Failed to initialize pool: IO Error: Unknown host specified
com.streamsets.datacollector.runner.PipelineRuntimeException: CONTAINER_0800 - Can't start pipeline due 1 validation error(s). First one: JDBC_06 - Failed to initialize connection pool: com.zaxxer.hikari.pool.HikariPool$PoolInitializationException: Failed to initialize pool: IO Error: Unknown host specified
Thank you in advance.
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ITWhisperer
SplunkTrust
05-02-2021
11:14 PM
| rex "user:\*(?<user>[^\]]+)\]\s\[pipeline:(?<pipeline>[^\s]+).*:\s(?<error>[^:]+)"- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ITWhisperer
SplunkTrust
05-02-2021
11:14 PM
| rex "user:\*(?<user>[^\]]+)\]\s\[pipeline:(?<pipeline>[^\s]+).*:\s(?<error>[^:]+)"- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Nidd
Path Finder
05-04-2021
07:31 AM
Thank you very much ITWhisperer !! 🙂 Worked !!
Got questions? Get answers!
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Meet up IRL or virtually!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Get Updates on the Splunk Community!
Quick connection discovery mode for forwarders
When a Splunk forwarder loses connectivity to its indexers, it does not always reconnect immediately. In many ...
Build and Launch AI Agents from Your Splunk Workflows
Register
We’ve all been there: juggling alerts, runbooks, and endless manual searches. What if you could ...
Splunk Cloud Application Management in Terraform
Register
On Tuesday, August 4 at 11AM PDT / 2PM EDT, we’re diving into how you can bring Infrastructure as ...
