Splunk Search

How do I edit my "eval field=substr..." syntax to remove part of a stacktrace after a certain string?

sickyb
Engager

Hi

I'm trying to create a dashboard where I count stacktraces in the logging. (the long term goal is to get rid off all stacktraces but we need to prioritize 🙂 )

To do this, I need to cut off the low level part of the stacktrace, the part that doesn't come from our code, but from the libraries that are packed with the distribution of the OS.

The cut-off point is easily recognized because it starts with at android.os, so I need to do something like:

eval action=substr(action,0,<xxx>) 

where <xxx> is the position in the string that starts with "at android.os"

Any ideas on how to do this?

Tags (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Are you married to using substr? If not, rex can do the job. Try

... | rex field=action "(?<action>.*) at android\.os" | ...
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Are you married to using substr? If not, rex can do the job. Try

... | rex field=action "(?<action>.*) at android\.os" | ...
---
If this reply helps you, Karma would be appreciated.

sickyb
Engager

Nope not married to substr but your regex leaves me with an error

Regex: unrecognized character after (? or (?-

So I added the fieldname after the ? leaving me with

rex field=action "(?/.*) at android\.os"

Which left me with the entire stacktrace once again. This led me to believe that the regex indeed matches the right string but then doesn't cut the rest of it. Beacause the stacktrace is sent from a mobile device it is compacted in a single line, no endlines there. So when I added mode=sed to the expression I got

Failed to initialize sed. cannot find sed command: (
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The board dropped a key piece from my answer, which I have corrected. Try again.

---
If this reply helps you, Karma would be appreciated.
0 Karma

sickyb
Engager

That is precisely what i did. but like i said that leaves me with the entire stacktrace instead of just the part before the "at android.os"

the editor for this q&a forum probably does some input sanitation throwing away the part with the triangular brackets
< >

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Hmm... I wonder if rex needs separate field names. Try

rex field=action "(?<newAction>.*) at android\.os"
---
If this reply helps you, Karma would be appreciated.
0 Karma

sickyb
Engager

Nope still the same.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Did you remove the 'mode=sed'? Can you share a stacktrace so I can make sure the regex is correct?

---
If this reply helps you, Karma would be appreciated.
0 Karma

sickyb
Engager

java.lang.NullPointerException: Attempt to invoke virtual method 'android.content.SharedPreferences android.content.Context.getSharedPreferences(java.lang.String, int)' on a null object reference at rd.random.mized.a.a(SourceFile:26) at rd.random.mized.connectivity.statusapp.d.b(SourceFile:89) at rd.random.mized.connectivity.statusapp.d.a(SourceFile:50) at rd.random.mized.c.a.a(SourceFile:99) at rd.random.mized.c.a.a(SourceFile:49) at rd.random.mized.connectivity.statusapp.c.a(SourceFile:47) at rd.random.mized.connectivity.statusapp.c.a(SourceFile:28) at rd.random.mized.connectivity.ConnectionHandler$1.run(SourceFile:101) at android.os.Handler.handleCallback(Handler.java:739) at android.os.Handler.dispatchMessage(Handler.java:95) at android.os.Looper.loop(Looper.java:145) at android.app.ActivityThread.main(ActivityThread.java:5832) at java.lang.reflect.Method.invoke(Native Method) at java.lang.reflect.Method.invoke(Method.java:372) at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:1399) at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:1194)

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Thanks for the example event. This rex command works with that data.

rex field=action "(?<newAction>.*?) at android\.os"
---
If this reply helps you, Karma would be appreciated.
0 Karma

sickyb
Engager

In the end creating a new field using this regex for the extraction worked.

^.*native-shell\;(?P<native_android_stacktrace>.*)\tat\ android.os.Handler  

The native-shell part is added because the field extraction is done on the RAW data instead of the action field.
Learning something new every day 🙂 Let's continue doing that in 2016, Happy new year
and Thanks for the help.

0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...