How to extract error message from java error logs?

[mail2uharishp]

Hi All,

Could you please help in extracting the error log from java error log.

I would like to see the result in a table format
Code | Message
1234 | due to system error

Error log is as below

message: Exception Occurred ::org.springframework.web.client.HttpClientErrorException$BadRequest: 400 Bad Request: [{"code":"1234","reason":"due to system error.","type":"ValidationException"}]
at org.springframework.web.client.HttpClientErrorException.create(HttpClientErrorException.java:303)
at org.springframework.web.client.DefaultResponseErrorHandler.handleError(DefaultResponseErrorHandler.java:384)
at org.springframework.web.client.DefaultResponseErrorHandler.handleError(DefaultResponseErrorHandler.java:325)
......

I have tried few extractions from splunk searches, however nothing were fruitful.

[mail2uharishp]

No @yuanliu , it is still returning a blank data for me

I have added table to your query only, apart from providing index my query looks like below

index = myindex "searchfields"
| rex mode=sed "s/Bad Request: */Bad_Request=/" ``` extract JSON array ```
| kv
| spath input=Bad_Request path={}
| mvexpand {} ``` in case there are multiple elements in JSON array ```
| spath input={}
| fields code reason
|table code reason

[yuanliu]

This may mean that your data isn't exactly like you illustrated.  Let's diagnose step by step. (table command will not do anything special if you already see blank.) Please post result from the following (anonymize as needed):

| search "Bad Request:" ``` only bad requests of interest ```
| rex mode=sed "s/Bad Request:\s*/Bad_Request=/" ``` extract JSON array ```
| kv
| table Bad_Request

Emulated output

The following is the emulation I use, and the result I get from your sample data:

| makeresults
| fields - _time
| eval _raw = "message: Exception Occurred ::org.springframework.web.client.HttpClientErrorException: 400 Bad Request: [{\"code\":\"1234\",\"reason\":\"due to system error.\",\"type\":\"ValidationException\"}]
at org.springframework.web.client.HttpClientErrorException.create(HttpClientErrorException.java:303)
at org.springframework.web.client.DefaultResponseErrorHandler.handleError(DefaultResponseErrorHandler.java:384)
at org.springframework.web.client.DefaultResponseErrorHandler.handleError(DefaultResponseErrorHandler.java:325)
......"
``` data emulation above ```
| rex mode=sed "s/Bad Request: */Bad_Request=/" ``` extract JSON array ```
| kv
| table Bad_Request _raw

The output is

Bad_Request

_raw

[{"code":"1234","reason":"due to system error.","type":"ValidationException"}]

message: Exception Occurred ::org.springframework.web.client.HttpClientErrorException: 400 Bad_Request=[{"code":"1234","reason":"due to system error.","type":"ValidationException"}] at org.springframework.web.client.HttpClientErrorException.create(HttpClientErrorException.java:303) at org.springframework.web.client.DefaultResponseErrorHandler.handleError(DefaultResponseErrorHandler.java:384) at org.springframework.web.client.DefaultResponseErrorHandler.handleError(DefaultResponseErrorHandler.java:325) ......

Do you get similar output?

[yuanliu]

| rex mode=sed "s/Bad Request: */Bad_Request=/" ``` extract JSON array ```
| kv
| spath input=Bad_Request path={}
| mvexpand {} ``` in case there are multiple elements in JSON array ```
| spath input={}
| fields code reason

Hope this helps

[mail2uharishp]

No @yuanliu 

I am seeing entire error message as is if i exactly use your query and if I add table field then null values are being returned