Splunk Search

How do I group fairly unstructured events by specific words that they contain?

samsam48
Explorer

I have data that doesn't contain many useful fields. I have an initial query that returns a large set of events, and I want to be able to group these events by specific words that they may contain somewhere in their bodies. The pre-chosen words I want to group them by are: "IndexOutOfBoundsException", "NullPointerException", and "Error".

One event may be:

ERROR 08-30 14:17:55.089 [someExecute] Afile(#lineNumber) {personid}: Fake try-catch to throw a IndexOutOfBoundsException 
inside processFunction 
java.lang.StringIndexOutOfBoundsException: String index out of range: -23
    at java.lang.String.substring(String.java:1931)
    at Listener.processMessage(Listener.java:479)
    at Listener.onMessage(GroupPositionsListener.java:450)

Since this event contains the word "IndexOutOfBounds", it should fall into an "index" bucket or group. Is it possible to do this while still retaining the ability to perform other operations on each of the now grouped events? Maybe by counting them or pulling out specific text with a regex for each?

I figure this would be more straight forward if the events were already indexed by a field "error-type" that sorted them by their containing a specific error or the like.

Any suggestions are really appreciated.

Tags (2)
0 Karma
1 Solution

horsefez
SplunkTrust
SplunkTrust

Hi @samsam48,

regular expressions is the best idea you can have for solving this question. 😃

Try the following in SPL:

yourbasesearch | rex field=_raw max_match=1 "(?<error_type>IndexOutOfBoundsException|NullPointerException|Error)"

You'll get a field that classifies your event into one of the three categories. Tell me if it works, or if you encounter some problems.

View solution in original post

horsefez
SplunkTrust
SplunkTrust

Hi @samsam48,

regular expressions is the best idea you can have for solving this question. 😃

Try the following in SPL:

yourbasesearch | rex field=_raw max_match=1 "(?<error_type>IndexOutOfBoundsException|NullPointerException|Error)"

You'll get a field that classifies your event into one of the three categories. Tell me if it works, or if you encounter some problems.

View solution in original post

samsam48
Explorer

Hi @pyro_wood,

This is great. Thanks!

0 Karma

horsefez
SplunkTrust
SplunkTrust

You're welcome! 🙂

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.