Splunk Search

How do I group fairly unstructured events by specific words that they contain?

samsam48
Explorer

I have data that doesn't contain many useful fields. I have an initial query that returns a large set of events, and I want to be able to group these events by specific words that they may contain somewhere in their bodies. The pre-chosen words I want to group them by are: "IndexOutOfBoundsException", "NullPointerException", and "Error".

One event may be:

ERROR 08-30 14:17:55.089 [someExecute] Afile(#lineNumber) {personid}: Fake try-catch to throw a IndexOutOfBoundsException 
inside processFunction 
java.lang.StringIndexOutOfBoundsException: String index out of range: -23
    at java.lang.String.substring(String.java:1931)
    at Listener.processMessage(Listener.java:479)
    at Listener.onMessage(GroupPositionsListener.java:450)

Since this event contains the word "IndexOutOfBounds", it should fall into an "index" bucket or group. Is it possible to do this while still retaining the ability to perform other operations on each of the now grouped events? Maybe by counting them or pulling out specific text with a regex for each?

I figure this would be more straight forward if the events were already indexed by a field "error-type" that sorted them by their containing a specific error or the like.

Any suggestions are really appreciated.

Tags (2)
0 Karma
1 Solution

horsefez
Motivator

Hi @samsam48,

regular expressions is the best idea you can have for solving this question. 😃

Try the following in SPL:

yourbasesearch | rex field=_raw max_match=1 "(?<error_type>IndexOutOfBoundsException|NullPointerException|Error)"

You'll get a field that classifies your event into one of the three categories. Tell me if it works, or if you encounter some problems.

View solution in original post

horsefez
Motivator

Hi @samsam48,

regular expressions is the best idea you can have for solving this question. 😃

Try the following in SPL:

yourbasesearch | rex field=_raw max_match=1 "(?<error_type>IndexOutOfBoundsException|NullPointerException|Error)"

You'll get a field that classifies your event into one of the three categories. Tell me if it works, or if you encounter some problems.

samsam48
Explorer

Hi @pyro_wood,

This is great. Thanks!

0 Karma

horsefez
Motivator

You're welcome! 🙂

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...