Splunk Search

Filter logs by thread name and display in table

splunksridhar
New Member

Hi, I am new to splunk and know the basics of search. Below is how my logs looks like.

2016-08-03 23:51:00,607 INFO  [jmsContainer-5] ...
2016-08-03 23:31:06,453 INFO  [jmsContainer-1] ...
2016-08-03 23:39:06,123 INFO  [jmsContainer-10] ...
2016-08-03 23:20:06,581 INFO  [jmsContainer-1] ...
2016-08-03 23:43:06,660 INFO  [jmsContainer-15] ...
2016-08-03 23:32:07,551 INFO  [jmsContainer-2] ...

I need to filter only the latest event from each jmsContainer (jmsContainer-1, jmsContainer-2,...jmsContainer-15) and show in as table like below.

jmsContainer    _time                     _raw
jmsContainer-1  2016-08-03 23:31:06,453     ...
jmsContainer-2  2016-08-03 23:31:07,551     ...
.
.
jmsContainer-15

I read about merge multiple search queries but that does not help me. Right now I have started as simple as

jmsContainer-* | head 1 |  table _time _raw

I know that was not the good solution, any help is much appreciated.

0 Karma

inventsekar
SplunkTrust
SplunkTrust

check this one..
index=main sourcetype=jmslogs | rex field=_raw "(?ms)^\s+(?P\d+\-\d+\-\d+\s+\d+:\d+:\d+,\d+) INFO \[(?P[^\]]+)" | table jmsContainer date _raw

jmsContainer    date                                     _raw
jmsContainer-2  2016-08-03 23:32:07,551  2016-08-03 23:32:07,551 INFO  [jmsContainer-2] ...
jmsContainer-15 2016-08-03 23:43:06,660  2016-08-03 23:43:06,660 INFO  [jmsContainer-15] ...
jmsContainer-1  2016-08-03 23:20:06,581  2016-08-03 23:20:06,581 INFO  [jmsContainer-1] ...
jmsContainer-10 2016-08-03 23:39:06,123  2016-08-03 23:39:06,123 INFO  [jmsContainer-10] ...
jmsContainer-1  2016-08-03 23:31:06,453  2016-08-03 23:31:06,453 INFO  [jmsContainer-1] ...
jmsContainer-5  2016-08-03 23:51:00,607  2016-08-03 23:51:00,607 INFO  [jmsContainer-5] ...
thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

sundareshr
Legend

Try this

index=yourindexname "*jmsContainer*" | rex "(?<thread>\[jmsContainer[^\]]+\])"  | stats first(_time) as time first(_raw) as raw by thread
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...