Help with field extraction and table

[splunknoob]

Hi 

I hope someone can help me .. I am completely new to Splunk. Although I love it so far I don't really know how to use it. 

I want to filter for events only containing mongodbX and Couldn't get a connection.

The event can have mongodb1 or mongodb2 or mongodb3 as in example.

And use the filtered events to build a graph.

Example event: 

{"time":"2020-07-24T11:48:21.18957143Z","event":"2020-07-24T11:48:21.189+0000 I REPL_HB  [replexec-949] Error in heartbeat (requestId: 649360) to mongodb3:27017, response status: NetworkInterfaceExceededTimeLimit: Couldn't get a connection within the time limit\n","hostname":"node2"}

Thank you 

[gcusello]

Hi @splunknoob,

at first follow the Splunk Free corses  (https://www.splunk.com/en_us/training/free-courses/splunk-fundamentals-1.html) and The Splunk search Tutorial (https://docs.splunk.com/Documentation/Splunk/8.0.5/SearchTutorial/WelcometotheSearchTutorial).

Anyway, you have two ways to search in Splunk:

• full text search: in other words, using Splunk as Google search inserting the words to search;
• structured search: extract fields and search on fields, it's faster than the other but it requests more work.

In your sample you can use the first:

index=your_index mongodb* "Couldn't get a connection"
| ...

Ciao.

Giuseppe

[splunknoob]

Hi @gcusello 

Thanks a lot for your reply and help. Really appreciate it.

I will definitely take the fundamentals course.

Your suggestion works and I only see events with what I need. 

----

Could someone please help me with next part?

I need to build a graph when mongodb1 or 2 or 3 goes down.

Thank you

[gcusello · Accepted solution]

Hi @splunknoob,

try something like this:

index=your_index mongodb* "Couldn't get a connection"
| rex "Error\s+in\s+heartbeat\s+\(requestId:\s+\d+\)\s+to\s+(?<mongo>[^:]+)"
| timechart count BY mongo

in this way you can trace all the downs of your systems divided by mongodb.

If you want to check the regex see at https://regex101.com/r/y67Fa0/1

Ciao.

Giuseppe