Splunk Search

Filter access log by time of exceptions in syslog with splunk

staffang
New Member

I have a log4j syslog which throws a few nullpointers every day like:

2015-10-05 00:00:53,042 ERROR DefaultExceptionMapper - Unexpected error occurred
java.lang.NullPointerException
    at some.java.code.of.mine(SomeJavaFileOfMine.java:318)`

I am having some thoughts about these calls being from google-bots indexing the webpage and I would hence like to figure out which IP-adresses that are causing these exceptions by comparing the time of the exception with the times in our access logs.

An event in the access log looks something like:

2XX.1XX.XXX.XXX - - [05/Oct/2015:10:48:02 +0200] 
"GET SOMETHING HTTP/1.1" 200 31912 "SOME URL" 
"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:41.0) 
Gecko/20100101 Firefox/41.0" www.someurl.com SOME_STAT_COOKIE_ID=-

How do I do to get a list of the ip-adresses which are making requests at all of times certain exceptinos occur in my syslog?

I have tried with the following Splunk-query but with no results:

source="access_log" | eval timez=strftime(_time, "%H:%M %m-%d-%y") | search [search source="frontend.log" SomeJavaFileOfMine "java.lang.NullPointerException" | eval timez=strftime(_time, "%H:&M %m-%d-%y") | fields timez]
Tags (1)
0 Karma

woodcock
Esteemed Legend

Like this:

search source="frontend.log" SomeJavaFileOfMine "java.lang.NullPointerException" | eval exceptionTime = _time | map search="search earliest=$exceptionTime$ latest=$exceptionTime$ source="access_log | stats count by IPAddressFieldName"
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...

Customer success is front and center at .conf25

Hi Splunkers, If you are not able to be at .conf25 in person, you can still learn about all the latest news ...

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...