Splunk Search

How do I extract certain data from the log? weblogic

yeisonv
Explorer

Hi all. I am new to using splunk. I am trying to be able to extract data from a log for the last 15 minutes.

I try to generate the alert, every time an implementation of "Weblogic AdminServer" is made on the different hosts we have with splunk

I would need to know who made it, host, application and cluster. I used raw to extract it but it didn't work

index=wls sourcetype=wls_adminserver 

host=EWL1522

user=<torrelia>

app= consumer

cluster=homo3.8_cl1

####<Jul 24, 2020, 4:27:27,117 PM ART> <Info> <J2EE Deployment SPI> <EWL1522> <AdminServer> <[ACTIVE] ExecuteThread: '48' for queue: 'weblogic.kernel.Default (self-tuning)'> <torrelia> <> <4e1f868c-178a-4316-8cc0-a631e22c8aee-0014f65f> <1595618847117> <[severity-value: 64] [rid: 0] [partition-id: 0] [partition-name: DOMAIN] > <BEA-260121> <Initiating start operation for application,consumer#1.0 [archive: null], to homo3.8_cl1 .>

anyone who can help me

thanks.

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust
Please share the alert query.
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

You can use the rex command to extract those fields.

index=wls sourcetype=wls_adminserver
| rex "(\<[^>]+> ){3}\<(?<Host>[^>]+)"
| rex "(\<[^>]+> ){6}\<(?<user>[^>]+)"
| rex "application,(?<app>[^#]+)"
| rex ", to (?<cluster>[\S]+)"

 

---
If this reply helps you, Karma would be appreciated.

yeisonv
Explorer

Thanks for answering
The problem is that the information I need does not reach me in the alert. The mail arrives like this

host

count

EWL15221

 

I had done something like that

Could you somehow email me only that information splunk

_raw

_time

host

index

linecount

source

sourcetype

splunk_server

####<Jul 24, 2020, 4:27:27,117 PM ART> <Info> <J2EE Deployment SPI> <EWL1522> <AdminServer> <[ACTIVE] ExecuteThread: '48' for queue: 'weblogic.kernel.Default (self-tuning)'> <torrelia> <> <4e1f868c-178a-4316-8cc0-a631e22c8aee-0014f65f> <1595618847117> <[severity-value: 64] [rid: 0] [partition-id: 0] [partition-name: DOMAIN] > <BEA-260121> <Initiating start operation for application, consumer#1.0 [archive: null], to homo3.8_cl1 .>Fri Jul 24 16:27:27 2020EWL1522wls1/u03/oracle/logs/domains/homo3_domain8/AdminServer_yyyy-MM-dd.logwls_adminserverEWL1522

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust
Please share the alert query.
---
If this reply helps you, Karma would be appreciated.

yeisonv
Explorer

Thanks, use part of the query you sent.

index=wls sourcetype=wls_adminserver
| rex "(\<[^>]+> ){3}\<(?<AdminServer>[^>]+)"
| rex "(\<[^>]+> ){6}\<(?<User>[^>]+)"
| rex "application,(?<App>[^#]+)"
| rex ", to (?<Cluster>[\S]+)"
| stats count by AdminServer, _time, User, App, Cluster | where count > 2

 

Thanks 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Hmm.. You should be receiving count, AdminServer, _time, User, App, and Cluster information in your alert emails. Seeing just host and count would imply the stats command is only using those two fields, but that's not the case.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...