Splunk Search

How do I extract useful information into fields from Oracle WebLogic Application Server logs?

Rob_Jordan
Explorer

I want to extract fields from WebLogic logs to use in reports.

Ron_Naken
Splunk Employee
Splunk Employee

Rob_Jordan
Explorer
  1. In the splunk console, goto Manager --> Fields --> Fields --> Field extractions

  2. Click New

  3. Fill in the form for a new field extraction (you can use the examples I will provide below)

    • Destination app: search
    • Name: Enter a descriptive name for the field you are extracting here
    • Apply to: host named: *
    • Type: Inline
    • Extraction/Transform: Enter your regex for field extraction here
  4. Click Save

Note: If you are familiar with Splunk, you can tweak the Apply to filter to your liking.

You will now see additional fields available on the left whenever a search matches the regex pattern you entered and can start using these in graphs and reports.

Below are templates for step 3 to help get you started. These are working for me with WebLogic 10.3 logs.

  • Destination app: search
  • Name: BEA Info
  • Apply to: host named: *
  • Type: Inline
  • Extraction/Transform: T>\s<(?P<BEA_LOG_LEVEL>\w*)>\s<(?P<BEA_MSG_TYPE>\w*)>\s<(?P<BEA_MACHINE>\w*)>\s<(?P<BEA_SERVER>\w*)>

  • Destination app: search

  • Name: BEA Code
  • Apply to: host named: *
  • Type: Inline
  • Extraction/Transform: <(?P<BEA_CODE>BEA-\d\d\d\d\d\d)>

  • Destination app: search

  • Name: BEA Server State
  • Apply to: host named: *
  • Type: Inline
  • Extraction/Transform: (?P<BEA_SERVER_STATE>\w*)>

  • Destination app: search

  • Name: Java Lang
  • Apply to: host named: *
  • Type: Inline
  • Extraction/Transform: java\.lang\.(?P<JAVA_LANG>\w*)

  • Destination app: search

  • Name: Oracle Code
  • Apply to: host named: *
  • Type: Inline
  • Extraction/Transform: (?P<ORACLE_CODE>ORA-\d\d\d\d\d)

Rob

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!