Splunk Search

Help with field extraction and table

splunknoob
Engager

Hi 

I hope someone can help me .. I am completely new to Splunk. Although I love it so far I don't really know how to use it. 

I want to filter for events only containing mongodbX and Couldn't get a connection.

The event can have mongodb1 or mongodb2 or mongodb3 as in example.

And use the filtered events to build a graph.

Example event: 

{"time":"2020-07-24T11:48:21.18957143Z","event":"2020-07-24T11:48:21.189+0000 I REPL_HB  [replexec-949] Error in heartbeat (requestId: 649360) to mongodb3:27017, response status: NetworkInterfaceExceededTimeLimit: Couldn't get a connection within the time limit\n","hostname":"node2"}

Thank you 

Labels (4)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @splunknoob,

try something like this:

index=your_index mongodb* "Couldn't get a connection"
| rex "Error\s+in\s+heartbeat\s+\(requestId:\s+\d+\)\s+to\s+(?<mongo>[^:]+)"
| timechart count BY mongo

in this way you can trace all the downs of your systems divided by mongodb.

If you want to check the regex see at https://regex101.com/r/y67Fa0/1

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @splunknoob,

at first follow the Splunk Free corses  (https://www.splunk.com/en_us/training/free-courses/splunk-fundamentals-1.html) and The Splunk search Tutorial (https://docs.splunk.com/Documentation/Splunk/8.0.5/SearchTutorial/WelcometotheSearchTutorial).

Anyway, you have two ways to search in Splunk:

  • full text search: in other words, using Splunk as Google search inserting the words to search;
  • structured search: extract fields and search on fields, it's faster than the other but it requests more work.

In your sample you can use the first:

index=your_index mongodb* "Couldn't get a connection"
| ...

Ciao.

Giuseppe

splunknoob
Engager

Hi @gcusello 

Thanks a lot for your reply and help. Really appreciate it.

I will definitely take the fundamentals course.

Your suggestion works and I only see events with what I need. 

----

Could someone please help me with next part?

I need to build a graph when mongodb1 or 2 or 3 goes down.

Thank you

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @splunknoob,

try something like this:

index=your_index mongodb* "Couldn't get a connection"
| rex "Error\s+in\s+heartbeat\s+\(requestId:\s+\d+\)\s+to\s+(?<mongo>[^:]+)"
| timechart count BY mongo

in this way you can trace all the downs of your systems divided by mongodb.

If you want to check the regex see at https://regex101.com/r/y67Fa0/1

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...