Splunk Search

How to extract error message from java error logs?

mail2uharishp
Observer

Hi All,

Could you please help in extracting the error log from java error log.

I would like to see the result in a table format
Code | Message
1234 | due to system error


Error log is as below


message: Exception Occurred ::org.springframework.web.client.HttpClientErrorException$BadRequest: 400 Bad Request: [{"code":"1234","reason":"due to system error.","type":"ValidationException"}]
at org.springframework.web.client.HttpClientErrorException.create(HttpClientErrorException.java:303)
at org.springframework.web.client.DefaultResponseErrorHandler.handleError(DefaultResponseErrorHandler.java:384)
at org.springframework.web.client.DefaultResponseErrorHandler.handleError(DefaultResponseErrorHandler.java:325)
......

I have tried few extractions from splunk searches, however nothing were fruitful.

Labels (1)
0 Karma

mail2uharishp
Observer

No @yuanliu , it is still returning a blank data for me

I have added table to your query only, apart from providing index my query looks like below

index = myindex "searchfields"
| rex mode=sed "s/Bad Request: */Bad_Request=/" ``` extract JSON array ```
| kv
| spath input=Bad_Request path={}
| mvexpand {} ``` in case there are multiple elements in JSON array ```
| spath input={}
| fields code reason
|table code reason

 

0 Karma

yuanliu
SplunkTrust
SplunkTrust

This may mean that your data isn't exactly like you illustrated.  Let's diagnose step by step. (table command will not do anything special if you already see blank.) Please post result from the following (anonymize as needed):

 

 

| search "Bad Request:" ``` only bad requests of interest ```
| rex mode=sed "s/Bad Request:\s*/Bad_Request=/" ``` extract JSON array ```
| kv
| table Bad_Request

 

 

Emulated output

The following is the emulation I use, and the result I get from your sample data:

 

 

| makeresults
| fields - _time
| eval _raw = "message: Exception Occurred ::org.springframework.web.client.HttpClientErrorException: 400 Bad Request: [{\"code\":\"1234\",\"reason\":\"due to system error.\",\"type\":\"ValidationException\"}]
at org.springframework.web.client.HttpClientErrorException.create(HttpClientErrorException.java:303)
at org.springframework.web.client.DefaultResponseErrorHandler.handleError(DefaultResponseErrorHandler.java:384)
at org.springframework.web.client.DefaultResponseErrorHandler.handleError(DefaultResponseErrorHandler.java:325)
......"
``` data emulation above ```
| rex mode=sed "s/Bad Request: */Bad_Request=/" ``` extract JSON array ```
| kv
| table Bad_Request _raw

 

 

 

The output is

Bad_Request_raw
[{"code":"1234","reason":"due to system error.","type":"ValidationException"}]message: Exception Occurred ::org.springframework.web.client.HttpClientErrorException: 400 Bad_Request=[{"code":"1234","reason":"due to system error.","type":"ValidationException"}] at org.springframework.web.client.HttpClientErrorException.create(HttpClientErrorException.java:303) at org.springframework.web.client.DefaultResponseErrorHandler.handleError(DefaultResponseErrorHandler.java:384) at org.springframework.web.client.DefaultResponseErrorHandler.handleError(DefaultResponseErrorHandler.java:325) ......

Do you get similar output?

0 Karma

yuanliu
SplunkTrust
SplunkTrust
| rex mode=sed "s/Bad Request: */Bad_Request=/" ``` extract JSON array ```
| kv
| spath input=Bad_Request path={}
| mvexpand {} ``` in case there are multiple elements in JSON array ```
| spath input={}
| fields code reason

Hope this helps

Tags (4)
0 Karma

mail2uharishp
Observer

No @yuanliu 

I am seeing entire error message as is if i exactly use your query and if I add table field then null values are being returned

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...