Splunk Search

Tabulate list of exception in logs

thaara
Explorer

Hi Splunkers,

My logs are like below with same set of logs for different WAS ear's..

earFile=abc.ear
...................................
Error1: Exception with DMGR.....
Dbjbafjbjasbfbuasbhcbjsa

earFile=qrs.ear
...................................
Error2: SOAP exception..
skbdjasbjdgajsgdgush

My query should seach 'Error1' and 'Error2' keyword. In result, it should shows whole error message..

For eg,

If i search 'Error1' & 'Error2' in my query, output should be like below in table format...

Host EAR_Name Error
xyz abc.ear Error1: Exception with DMGR.....
Dbjbafjbjasbfbuasbhcbjsa

xyz qrs.ear Error2: SOAP exception..
skbdjasbjdgajsgdgush

0 Karma

dindu
Contributor

Could you please try the below.

   |index="your_index" sourcetype="" Error1 Error2
   |rex field=_raw "(?P<err_message>Error.*)"
    |table host,earFile,err_message
0 Karma

richgalloway
SplunkTrust
SplunkTrust

What is your current query? What are your current results?

---
If this reply helps you, an upvote would be appreciated.
0 Karma

thaara
Explorer

Current query:
index= " " sorucetype= " " Error

Result:
we are getting all the error patterns, but not in tabular format.

Expected output:
Hostname ear.name type of exception
xyz xyz.ear DMGR exception
abc abc.ear SOAP exception

0 Karma

richgalloway
SplunkTrust
SplunkTrust

As @dindu's answer suggests, you can use the table command to put your results in tabular form.
See https://www.splunk.com/en_us/training/free-courses/splunk-fundamentals-1.html.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!