Splunk Search

Filter logs by thread name and display in table

splunksridhar
New Member

Hi, I am new to splunk and know the basics of search. Below is how my logs looks like.

2016-08-03 23:51:00,607 INFO  [jmsContainer-5] ...
2016-08-03 23:31:06,453 INFO  [jmsContainer-1] ...
2016-08-03 23:39:06,123 INFO  [jmsContainer-10] ...
2016-08-03 23:20:06,581 INFO  [jmsContainer-1] ...
2016-08-03 23:43:06,660 INFO  [jmsContainer-15] ...
2016-08-03 23:32:07,551 INFO  [jmsContainer-2] ...

I need to filter only the latest event from each jmsContainer (jmsContainer-1, jmsContainer-2,...jmsContainer-15) and show in as table like below.

jmsContainer    _time                     _raw
jmsContainer-1  2016-08-03 23:31:06,453     ...
jmsContainer-2  2016-08-03 23:31:07,551     ...
.
.
jmsContainer-15

I read about merge multiple search queries but that does not help me. Right now I have started as simple as

jmsContainer-* | head 1 |  table _time _raw

I know that was not the good solution, any help is much appreciated.

0 Karma

inventsekar
SplunkTrust
SplunkTrust

check this one..
index=main sourcetype=jmslogs | rex field=_raw "(?ms)^\s+(?P\d+\-\d+\-\d+\s+\d+:\d+:\d+,\d+) INFO \[(?P[^\]]+)" | table jmsContainer date _raw

jmsContainer    date                                     _raw
jmsContainer-2  2016-08-03 23:32:07,551  2016-08-03 23:32:07,551 INFO  [jmsContainer-2] ...
jmsContainer-15 2016-08-03 23:43:06,660  2016-08-03 23:43:06,660 INFO  [jmsContainer-15] ...
jmsContainer-1  2016-08-03 23:20:06,581  2016-08-03 23:20:06,581 INFO  [jmsContainer-1] ...
jmsContainer-10 2016-08-03 23:39:06,123  2016-08-03 23:39:06,123 INFO  [jmsContainer-10] ...
jmsContainer-1  2016-08-03 23:31:06,453  2016-08-03 23:31:06,453 INFO  [jmsContainer-1] ...
jmsContainer-5  2016-08-03 23:51:00,607  2016-08-03 23:51:00,607 INFO  [jmsContainer-5] ...
thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

sundareshr
Legend

Try this

index=yourindexname "*jmsContainer*" | rex "(?<thread>\[jmsContainer[^\]]+\])"  | stats first(_time) as time first(_raw) as raw by thread
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...