Splunk Search

Help with field extraction and table

splunknoob
Engager

Hi 

I hope someone can help me .. I am completely new to Splunk. Although I love it so far I don't really know how to use it. 

I want to filter for events only containing mongodbX and Couldn't get a connection.

The event can have mongodb1 or mongodb2 or mongodb3 as in example.

And use the filtered events to build a graph.

Example event: 

{"time":"2020-07-24T11:48:21.18957143Z","event":"2020-07-24T11:48:21.189+0000 I REPL_HB  [replexec-949] Error in heartbeat (requestId: 649360) to mongodb3:27017, response status: NetworkInterfaceExceededTimeLimit: Couldn't get a connection within the time limit\n","hostname":"node2"}

Thank you 

Labels (4)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @splunknoob,

try something like this:

index=your_index mongodb* "Couldn't get a connection"
| rex "Error\s+in\s+heartbeat\s+\(requestId:\s+\d+\)\s+to\s+(?<mongo>[^:]+)"
| timechart count BY mongo

in this way you can trace all the downs of your systems divided by mongodb.

If you want to check the regex see at https://regex101.com/r/y67Fa0/1

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @splunknoob,

at first follow the Splunk Free corses  (https://www.splunk.com/en_us/training/free-courses/splunk-fundamentals-1.html) and The Splunk search Tutorial (https://docs.splunk.com/Documentation/Splunk/8.0.5/SearchTutorial/WelcometotheSearchTutorial).

Anyway, you have two ways to search in Splunk:

  • full text search: in other words, using Splunk as Google search inserting the words to search;
  • structured search: extract fields and search on fields, it's faster than the other but it requests more work.

In your sample you can use the first:

index=your_index mongodb* "Couldn't get a connection"
| ...

Ciao.

Giuseppe

splunknoob
Engager

Hi @gcusello 

Thanks a lot for your reply and help. Really appreciate it.

I will definitely take the fundamentals course.

Your suggestion works and I only see events with what I need. 

----

Could someone please help me with next part?

I need to build a graph when mongodb1 or 2 or 3 goes down.

Thank you

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @splunknoob,

try something like this:

index=your_index mongodb* "Couldn't get a connection"
| rex "Error\s+in\s+heartbeat\s+\(requestId:\s+\d+\)\s+to\s+(?<mongo>[^:]+)"
| timechart count BY mongo

in this way you can trace all the downs of your systems divided by mongodb.

If you want to check the regex see at https://regex101.com/r/y67Fa0/1

Ciao.

Giuseppe

Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...