Splunk Search
Highlighted

Extracting unique Null Pointer Exception from the logs via Splunk

New Member

I am looking to extract unique NullPointerException from the Splunk Logs. Unfortunately somehwere my regex is isnt extracting correctly.

Any input would be helpful.

Exception from the logs :

2018-10-24 20:19:09,664 DEBUG ExceptionHandlerExceptionResolver:133 - Resolving exception from handler [public com.json.SaveResponse com.controller.UIController.saveCoreScreen(javax.servlet.http.HttpServletRequest) throws java.lang.Exception]: java.lang.NullPointerException
2018-10-24 20:19:09,664 DEBUG DefaultListableBeanFactory:251 - Returning instance of 'globalExceptionHandler'
2018-10-24 20:19:09,664 ERROR GlobalExceptionHandler:134 - Generic Core Config Excpetion
java.lang.NullPointerException
at sun.reflect.GeneratedMethodAccessor2704.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)

I want my splunk queries to extract only NullPointerException with

2018-10-24 20:19:09,664 ERROR GlobalExceptionHandler:134 - Generic Core Config Excpetion
 java.lang.NullPointerException
at sun.reflect.GeneratedMethodAccessor2704.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)

and not the one with

2018-10-24 20:19:09,664 DEBUG ExceptionHandlerExceptionResolver:133 - Resolving exception from handler [public com.json.SaveResponse com.controller.UIController.saveCoreScreen(javax.servlet.http.HttpServletRequest) throws java.lang.Exception]: java.lang.NullPointerException

The thing that differentiate is it

ERROR term with the NullPointerException logs.

Any suggestion how could build with regex with it.

Thanks !

0 Karma
Highlighted

Re: Extracting unique Null Pointer Exception from the logs via Splunk

Ultra Champion

What did you try so far that didn't work?

Do you want to ingest all these events into splunk but only define extractions for the ERROR events, or do you want to filter out the DEBUG events altogether and only ingest the ERROR logs into Splunk?

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.