Splunk Search

How to extract error message from java error logs?

mail2uharishp
Observer

Hi All,

Could you please help in extracting the error log from java error log.

I would like to see the result in a table format
Code | Message
1234 | due to system error


Error log is as below


message: Exception Occurred ::org.springframework.web.client.HttpClientErrorException$BadRequest: 400 Bad Request: [{"code":"1234","reason":"due to system error.","type":"ValidationException"}]
at org.springframework.web.client.HttpClientErrorException.create(HttpClientErrorException.java:303)
at org.springframework.web.client.DefaultResponseErrorHandler.handleError(DefaultResponseErrorHandler.java:384)
at org.springframework.web.client.DefaultResponseErrorHandler.handleError(DefaultResponseErrorHandler.java:325)
......

I have tried few extractions from splunk searches, however nothing were fruitful.

Labels (1)
0 Karma

mail2uharishp
Observer

No @yuanliu , it is still returning a blank data for me

I have added table to your query only, apart from providing index my query looks like below

index = myindex "searchfields"
| rex mode=sed "s/Bad Request: */Bad_Request=/" ``` extract JSON array ```
| kv
| spath input=Bad_Request path={}
| mvexpand {} ``` in case there are multiple elements in JSON array ```
| spath input={}
| fields code reason
|table code reason

 

0 Karma

yuanliu
SplunkTrust
SplunkTrust

This may mean that your data isn't exactly like you illustrated.  Let's diagnose step by step. (table command will not do anything special if you already see blank.) Please post result from the following (anonymize as needed):

 

 

| search "Bad Request:" ``` only bad requests of interest ```
| rex mode=sed "s/Bad Request:\s*/Bad_Request=/" ``` extract JSON array ```
| kv
| table Bad_Request

 

 

Emulated output

The following is the emulation I use, and the result I get from your sample data:

 

 

| makeresults
| fields - _time
| eval _raw = "message: Exception Occurred ::org.springframework.web.client.HttpClientErrorException: 400 Bad Request: [{\"code\":\"1234\",\"reason\":\"due to system error.\",\"type\":\"ValidationException\"}]
at org.springframework.web.client.HttpClientErrorException.create(HttpClientErrorException.java:303)
at org.springframework.web.client.DefaultResponseErrorHandler.handleError(DefaultResponseErrorHandler.java:384)
at org.springframework.web.client.DefaultResponseErrorHandler.handleError(DefaultResponseErrorHandler.java:325)
......"
``` data emulation above ```
| rex mode=sed "s/Bad Request: */Bad_Request=/" ``` extract JSON array ```
| kv
| table Bad_Request _raw

 

 

 

The output is

Bad_Request_raw
[{"code":"1234","reason":"due to system error.","type":"ValidationException"}]message: Exception Occurred ::org.springframework.web.client.HttpClientErrorException: 400 Bad_Request=[{"code":"1234","reason":"due to system error.","type":"ValidationException"}] at org.springframework.web.client.HttpClientErrorException.create(HttpClientErrorException.java:303) at org.springframework.web.client.DefaultResponseErrorHandler.handleError(DefaultResponseErrorHandler.java:384) at org.springframework.web.client.DefaultResponseErrorHandler.handleError(DefaultResponseErrorHandler.java:325) ......

Do you get similar output?

0 Karma

yuanliu
SplunkTrust
SplunkTrust
| rex mode=sed "s/Bad Request: */Bad_Request=/" ``` extract JSON array ```
| kv
| spath input=Bad_Request path={}
| mvexpand {} ``` in case there are multiple elements in JSON array ```
| spath input={}
| fields code reason

Hope this helps

Tags (4)
0 Karma

mail2uharishp
Observer

No @yuanliu 

I am seeing entire error message as is if i exactly use your query and if I add table field then null values are being returned

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...