Splunk Search

Searching "Caused by: ..." messages from java stack trace

henrikg
New Member

Hi,

I'm new to Splunk searches and need help.

We currently have searches to filter out log messages with log level ERROR.
We want to take it one step further and build statistics based on the actual root cause.

The problem is that the root cause is almost always hidden in a long stack trace.

Example stack trace:
Exception in thread "main" java.lang.IllegalStateException: A book has a null property
at com.example.myproject.Author.getBookIds(Author.java:38)
at com.example.myproject.Bootstrap.main(Bootstrap.java:14)
Caused by: java.lang.NullPointerException
at com.example.myproject.Book.getId(Book.java:22)
at com.example.myproject.Author.getBookIds(Author.java:35)
... 1 more

And we are looking for: "java.lang.NullPointerException", and our stack traces can be very long...

Is there some way we can search for it in a good way? Or is there another way to handle this problem?

Thanks.

/ Henrik

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Is the entire stack trace in a single event? If so, you may be able to rex to find the root cause.

<your search> | rex "Caused by: (?<rootCause>[\w\.]*)" | ...
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Is the entire stack trace in a single event? If so, you may be able to rex to find the root cause.

<your search> | rex "Caused by: (?<rootCause>[\w\.]*)" | ...
---
If this reply helps you, Karma would be appreciated.
0 Karma

henrikg
New Member

Thanks a lot Rich, it worked perfectly!

I did some modifications since I realised I needed the last root cause (last Caused by: ...).
And I also needed the exception message. So I ended up with this:

rex "Caused by: (?<rootCause>[\w\.].*)(?![\s\S]*Caused by: )"

Not sure if there are any performance implications by doing this, but I will try that out tomorrow.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...