Extracting unique Null Pointer Exception from the logs via Splunk

[ashirgao]

I am looking to extract unique NullPointerException from the Splunk Logs. Unfortunately somehwere my regex is isnt extracting correctly.

Any input would be helpful.

Exception from the logs :

2018-10-24 20:19:09,664 DEBUG ExceptionHandlerExceptionResolver:133 - Resolving exception from handler [public com.json.SaveResponse com.controller.UIController.saveCoreScreen(javax.servlet.http.HttpServletRequest) throws java.lang.Exception]: java.lang.NullPointerException
2018-10-24 20:19:09,664 DEBUG DefaultListableBeanFactory:251 - Returning instance of 'globalExceptionHandler'
2018-10-24 20:19:09,664 ERROR GlobalExceptionHandler:134 - Generic Core Config Excpetion
java.lang.NullPointerException
at sun.reflect.GeneratedMethodAccessor2704.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)

I want my splunk queries to extract only NullPointerException with

2018-10-24 20:19:09,664 ERROR GlobalExceptionHandler:134 - Generic Core Config Excpetion
 java.lang.NullPointerException
at sun.reflect.GeneratedMethodAccessor2704.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)

and not the one with

2018-10-24 20:19:09,664 DEBUG ExceptionHandlerExceptionResolver:133 - Resolving exception from handler [public com.json.SaveResponse com.controller.UIController.saveCoreScreen(javax.servlet.http.HttpServletRequest) throws java.lang.Exception]: java.lang.NullPointerException

The thing that differentiate is it

ERROR term with the NullPointerException logs.

Any suggestion how could build with regex with it.

Thanks !

[FrankVl]

What did you try so far that didn't work?

Do you want to ingest all these events into splunk but only define extractions for the ERROR events, or do you want to filter out the DEBUG events altogether and only ingest the ERROR logs into Splunk?