Hi All,
I have number of events with error srtring in event.
I need to fetch al the events with error string except hibernet errors.
"ERROR org.hibernate.engine.jdbc.spi.SqlExceptionHelper - ORA-00001: unique constraint"
I am not sure about the logs with other errors..as there are multiple logs with hibernate error ..i cant be able to fetch it. i need to extract all other logs with error keyword in the event.
Can anyone please help me on the same.
Thanks in advance.
Hi @vineela,
at first, how do you have these logs?
if they are in text files you have to ingest them using a Universal Forwarder on the server where the files are stored and use a folder monitoring stanza in inputs.conf.
My hint is to see some video and read some documentation searching on Google and/or on YouTube "Splunk getting data in" like the following (these aren't the only ones available!)
https://docs.splunk.com/Documentation/Splunk/latest/Data/Getstartedwithgettingdatain
https://www.splunk.com/en_us/resources/videos/getting-data-in-to-splunk-enterprise-linux.html
When you'll have the logs inside Splunk you have to extract relevant fields and create you searches and statistics.
Ciao.
Giuseppe