Hi Splunkers,
My logs are like below with same set of logs for different WAS ear's..
earFile=abc.ear
...................................
Error1: Exception with DMGR.....
Dbjbafjbjasbfbuasbhcbjsa
earFile=qrs.ear
...................................
Error2: SOAP exception..
skbdjasbjdgajsgdgush
My query should seach 'Error1' and 'Error2' keyword. In result, it should shows whole error message..
For eg,
If i search 'Error1' & 'Error2' in my query, output should be like below in table format...
Host EAR_Name Error
xyz abc.ear Error1: Exception with DMGR.....
Dbjbafjbjasbfbuasbhcbjsa
xyz qrs.ear Error2: SOAP exception..
skbdjasbjdgajsgdgush
Could you please try the below.
|index="your_index" sourcetype="" Error1 Error2
|rex field=_raw "(?P<err_message>Error.*)"
|table host,earFile,err_message
What is your current query? What are your current results?
Current query:
index= " " sorucetype= " " Error
Result:
we are getting all the error patterns, but not in tabular format.
Expected output:
Hostname ear.name type of exception
xyz xyz.ear DMGR exception
abc abc.ear SOAP exception
As @dindu's answer suggests, you can use the table
command to put your results in tabular form.
See https://www.splunk.com/en_us/training/free-courses/splunk-fundamentals-1.html.