Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Splunk Search
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- How can I report on all of those thousands of BEA-...
Options
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Rob_Jordan
Explorer
05-18-2010
01:49 PM
How can I report on all of those thousands of BEA- messages in our weblogic logs?
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Rob_Jordan
Explorer
05-18-2010
01:50 PM
These searches will extract BEA- messages from the logs and report by message number
Example of a BEA Message:
####<Jan 1, 2009 2:34:07 PM CDT> <Error> <WebLogicServer> <hostname> <managedserver> <[ACTIVE] ExecuteThread: '8' for queue: 'weblogic.kernel.Default (self-tuning)'> <<WLS Kernel>> <> <> <1273606447204> <BEA-000337> <[STUCK] ExecuteThread: '3' for queue: 'weblogic.kernel.Default (self-tuning)' has been busy for "715" seconds working on the request
Use a regular expression to extract a custom field called BEA_MSG_NO
"<BEA-"|rex field=_raw "(?<BEA_MSG_NO>BEA-\d\d\d\d\d\d)"|stats count by BEA_MSG_NO
"<BEA-"|rex field=_raw "(?<BEA_MSG_NO>BEA-\d\d\d\d\d\d)"|timechart count by BEA_MSG_NO
"<BEA-"|rex field=_raw "(?<BEA_MSG_NO>BEA-\d\d\d\d\d\d)"|top BEA_MSG_NO limit=10000
NOTE: if you prefix your search with the sourcetype for your weblogic logs, your results should come back much faster.
sourcetype="*weblogic.out*" "<BEA-"|rex field=_raw "(?<BEA_MSG_NO>BEA-\d\d\d\d\d\d)"|stats count by BEA_MSG_NO
sourcetype="*weblogic.out*" "<BEA-"|rex field=_raw "(?<BEA_MSG_NO>BEA-\d\d\d\d\d\d)"|timechart count by BEA_MSG_NO
sourcetype="*weblogic.out*" "<BEA-"|rex field=_raw "(?<BEA_MSG_NO>BEA-\d\d\d\d\d\d)"|top BEA_MSG_NO limit=10000
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Rob_Jordan
Explorer
05-18-2010
01:50 PM
These searches will extract BEA- messages from the logs and report by message number
Example of a BEA Message:
####<Jan 1, 2009 2:34:07 PM CDT> <Error> <WebLogicServer> <hostname> <managedserver> <[ACTIVE] ExecuteThread: '8' for queue: 'weblogic.kernel.Default (self-tuning)'> <<WLS Kernel>> <> <> <1273606447204> <BEA-000337> <[STUCK] ExecuteThread: '3' for queue: 'weblogic.kernel.Default (self-tuning)' has been busy for "715" seconds working on the request
Use a regular expression to extract a custom field called BEA_MSG_NO
"<BEA-"|rex field=_raw "(?<BEA_MSG_NO>BEA-\d\d\d\d\d\d)"|stats count by BEA_MSG_NO
"<BEA-"|rex field=_raw "(?<BEA_MSG_NO>BEA-\d\d\d\d\d\d)"|timechart count by BEA_MSG_NO
"<BEA-"|rex field=_raw "(?<BEA_MSG_NO>BEA-\d\d\d\d\d\d)"|top BEA_MSG_NO limit=10000
NOTE: if you prefix your search with the sourcetype for your weblogic logs, your results should come back much faster.
sourcetype="*weblogic.out*" "<BEA-"|rex field=_raw "(?<BEA_MSG_NO>BEA-\d\d\d\d\d\d)"|stats count by BEA_MSG_NO
sourcetype="*weblogic.out*" "<BEA-"|rex field=_raw "(?<BEA_MSG_NO>BEA-\d\d\d\d\d\d)"|timechart count by BEA_MSG_NO
sourcetype="*weblogic.out*" "<BEA-"|rex field=_raw "(?<BEA_MSG_NO>BEA-\d\d\d\d\d\d)"|top BEA_MSG_NO limit=10000
Get Updates on the Splunk Community!
Enterprise Security Content Update (ESCU) | New Releases
In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
(This is the first of a series of 2 blogs).
Splunk Enterprise Security is a fantastic tool that offers robust ...
Index This | What are the 12 Days of Splunk-mas?
December 2024 Edition
Hayyy Splunk Education Enthusiasts and the Eternally Curious!
We’re back with another ...
