Hi All ,
1)How do you capture INFO/ERROR/WARN events using regular expression ?
2)How do you capture the rest of the events not including INFO/ERROR/WARN events using regular expression ?
Sample log looks like this
[30/07/18 17:42:00:492 XXX] 00000056 SystemOut O 30 Jul 2017 17:42:00:492 [INFO] [xxxxxx] [] xxxxx - The total memory is 411116 and the memory available is 2638295816.
[30/07/17 17:42:00:492 EST] 00000056 SystemOut O 30 Jul 2017 17:42:00:492 [INFO] [xxxxxx] [] xxxxxxx - The total memory is 111111111 and the memory available is 2638295816.
[30/07/17 17:42:00:492 XXX] 00000056 SystemOut O 30 Jul 2017 17:42:00:492 [INFO] [xxxxxx] [] xxxxxx - The total memory is 1111111 and the memory available is 2638295816.
[30/07/17 15:37:42:379 XXX] 00001db5 LdapConnectio I xxx.xxx.xx.xx.xxxxx.xxxx.xxxxxxxxxx reCreateDirContext(String errorMessage) xxxxxxxxx The user registry is now connected to 'xxxxxxxxxxxxxx' LDAP Server.
[30/07/17 15:33:59:281 XXX] 0000xxxx0 SystemOut O Into the constructor of xxxxx
Thanks
A regex like the one in the run-anywhere sample should do it.
| makeresults | eval _raw="[30/07/18 17:42:00:492 XXX] 00000056 SystemOut O 30 Jul 2017 17:42:00:492 [INFO] [xxxxxx] [] xxxxx - The total memory is 411116 and the memory available is 2638295816."
| rex "\[(?<log_level>(INFO|WARN|ERROR)[^\]]*)\](?<log_message>.*)"
The first line with makeresults and eval simple create a log line like yours is.
The second line is the rex, which creates a field "log_level" from your INFO, WARN or ERROR portion and "log_message" from all that's left to the end.
Happy Splunking,
Rich
@raj_mpl - sorry, I edited your "answer" and put it as a comment under this answer, because that's where it belongs, but .. somehow it got deleted? Well, no matter - I apologize, but I remember the question so I'll just add some answer here.
To get some statistics, I'd use either timechart or stats. For instance,
<your base search>
| rex "\[(?<log_level>(INFO|WARN|ERROR)[^\]]*)\](?<log_message>.*)"
| timechart count by log_level
or
<your base search>
| rex "\[(?<log_level>(INFO|WARN|ERROR)[^\]]*)\](?<log_message>.*)"
| stats count by log_level
the by log_level
could be by log_level, host
, or almost any other thing. Play with those two options and some variants and see where that gets you.
For reference:
The Splunk docs on stats
The Splunk docs on timechart
Hi @rich7177 thank you for your response , the query you have provided works fine ,can you give me a query to build same statistics for all the events in my log more than 2000+ each day