Splunk Search

How do I group fairly unstructured events by specific words that they contain?

samsam48
Explorer

I have data that doesn't contain many useful fields. I have an initial query that returns a large set of events, and I want to be able to group these events by specific words that they may contain somewhere in their bodies. The pre-chosen words I want to group them by are: "IndexOutOfBoundsException", "NullPointerException", and "Error".

One event may be:

ERROR 08-30 14:17:55.089 [someExecute] Afile(#lineNumber) {personid}: Fake try-catch to throw a IndexOutOfBoundsException 
inside processFunction 
java.lang.StringIndexOutOfBoundsException: String index out of range: -23
    at java.lang.String.substring(String.java:1931)
    at Listener.processMessage(Listener.java:479)
    at Listener.onMessage(GroupPositionsListener.java:450)

Since this event contains the word "IndexOutOfBounds", it should fall into an "index" bucket or group. Is it possible to do this while still retaining the ability to perform other operations on each of the now grouped events? Maybe by counting them or pulling out specific text with a regex for each?

I figure this would be more straight forward if the events were already indexed by a field "error-type" that sorted them by their containing a specific error or the like.

Any suggestions are really appreciated.

Tags (2)
0 Karma
1 Solution

horsefez
SplunkTrust
SplunkTrust

Hi @samsam48,

regular expressions is the best idea you can have for solving this question. 😃

Try the following in SPL:

yourbasesearch | rex field=_raw max_match=1 "(?<error_type>IndexOutOfBoundsException|NullPointerException|Error)"

You'll get a field that classifies your event into one of the three categories. Tell me if it works, or if you encounter some problems.

View solution in original post

horsefez
SplunkTrust
SplunkTrust

Hi @samsam48,

regular expressions is the best idea you can have for solving this question. 😃

Try the following in SPL:

yourbasesearch | rex field=_raw max_match=1 "(?<error_type>IndexOutOfBoundsException|NullPointerException|Error)"

You'll get a field that classifies your event into one of the three categories. Tell me if it works, or if you encounter some problems.

samsam48
Explorer

Hi @pyro_wood,

This is great. Thanks!

0 Karma

horsefez
SplunkTrust
SplunkTrust

You're welcome! 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...