Splunk SPL Examples for WebSphere SystemOut Logs

[cadm777]

We use Splunk, and I do know that our SystemOut logs are forwarded to the Splunk indexer. Does anyone have some example SPLs for searching indexes for WebSphere SystemOut Warnings "W" and SystemOut Errors "E"? Thanks.

For your reference, here is a link to IBM's WebSphere log interpretation: ibm.com/docs/en/was/8.5.5?topic=SSEQTP_8.5.5/…

[richgalloway]

The most important thing is to determine which index (not index*er*) holds the WebSphere logs.  That will narrow the scope of your search.

Once you have that information, you can begin your search.  Start with " W " and " E ".  Those aren't great strings for searching, but they're a start.  As you receive results, use what you find to add to the search string until have have what you want.

index=websphere (" W " OR " E ")

[cadm777]

The problem I am having is the raw data looks like this:  "[8/8/24 13:37:46:622 EDT] 00007e14 HOSTEDWIRES** I ************"

What I am trying to do is do a search on the raw data find the "W" and "E"

The problem I am having is the raw data looks like this:  "[8/8/24 13:37:46:622 EDT] 00007e14 HOSTEDWIRES** W ************"

or

The problem I am having is the raw data looks like this:  "[8/8/24 13:37:46:622 EDT] 00007e14 HOSTEDWIRES** E ************"

A basic search I am using: (Sorry, I had to obfuscate some of the SPL.

index="index" host IN ("Server 1","Server 2","Backup Server 1","Backup Server 2") source=* sourcetype=###_was_systemout_log | ("W" or "E")

In WebSphere SystemOut logs, the warning or error indicator comes after the timestamp and application type.  So, when I search for just ("W" or "E") it will pull everything that has "W" "E" in the text.  How do I isolate it to search for that after the application type, and before the transaction raw data?  I don't get to play with Splunk that much, so this is beyond my skill level.  I am still learning.  Thanks again for the help.

[richgalloway · Accepted solution]

Searching for "W" or "E" will return a lot of noise.  That's why my suggested query included spaces around each letter - the goal being to find the isolated severity codes.