How to extract events from logs

[vineela]

Hi All,

   I have number of events with error srtring in event.
I need to fetch al the events with error string except hibernet errors.
"ERROR org.hibernate.engine.jdbc.spi.SqlExceptionHelper - ORA-00001: unique constraint"

I am not sure about the logs with other errors..as there are multiple logs with hibernate error ..i cant be able to fetch it. i need to extract all other logs with error keyword in the event.

Can anyone please help me on the same.

Thanks in advance.

[gcusello]

Hi @vineela,

at first, how do you have these logs?

if they are in text files you have to ingest them using a Universal Forwarder on the server where the files are stored and use a folder monitoring stanza in inputs.conf.

My hint is to see some video and read some documentation searching on Google and/or on YouTube "Splunk getting data in" like the following (these aren't the only ones available!)

https://docs.splunk.com/Documentation/Splunk/latest/Data/Getstartedwithgettingdatain

https://www.splunk.com/en_us/resources/videos/getting-data-in-to-splunk-enterprise-linux.html 

When you'll have the logs inside Splunk you have to extract relevant fields and create you searches and statistics.

Ciao.

Giuseppe