Getting Data In

Line breaking C# stack trace

Saasen
New Member

Hi.

I'm currently trying to get the stack trace in C# in one event, not in multiple events. Please look at the attachment.
Is there any way of doing this? I've messed around with the props.config a while, but I can't get it to work.

I've been trying to follow this article: http://blogs.splunk.com/2010/02/18/breaking-up-is-hard-to-do/.

The logfiles usually looks something like this:

<188>May 12 07:15:23 NOQ06WS0104: [Platform - WARN] 2015-05-12T07:15:23.279, { MD_Class="Web.Configuration.NLogLogger", Message="10s warning - due time is Monday, May 11, 2015 2:07:31 PM",  }, Ude.Shared.Logging.Logger.Log

<188>May 12 07:15:23 NOQ06WS0104: [Platform  - WARN] 2015-05-12T07:15:23.279, { MD_Class="Web.Configuration.NLogLogger", Message="10s warning - due time is Monday, May 11, 2015 2:07:31 PM",  }, Ude.Shared.Logging.Logger.Log

<188>May 12 07:15:23 NOQ06WS0104: [Platform - WARN] 2015-05-12T07:15:23.279, { MD_Class="Web.Configuration.NLogLogger", Message="10s warning - due time is Monday, May 11, 2015 2:07:31 PM",  }, Ude.Shared.Logging.Logger.Log

<187>May 11 15:09:06 NOQ06WS0104: [Platform - ERROR] 2015-05-11T15:09:06.761, { MD_Application="Unknown", MD_Class="Web.EPiServerApplication", Message=" Url: https://xxx.yyy.zz/Api/Facebook Controller: Facebook",  }, The operation was canceled.,    at System.Threading.CancellationToken.ThrowIfCancellationRequested()    at System.Web.Http.WebHost.HttpControllerHandler.<WriteBufferedResponseContentAsync>d__1b.MoveNext() --- End of stack trace from previous location where exception was thrown ---    at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()    at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)    at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)    at System.Web.Http.WebHost.HttpControllerHandler.<CopyResponseAsync>d__7.MoveNext() --- End of stack trace from previous location where exception was thrown ---    at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()    at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)    at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)    at System.Web.Http.WebHost.HttpControllerHandler.<ProcessRequestAsyncCore>d__0.MoveNext() --- End of stack trace from previous location where exception was thrown ---    at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()    at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)    at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)    at System.Web.TaskAsyncHelper.EndTask(IAsyncResult ar)    at System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()    at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously), Shared.Logging.Logger.Log

One line should contain the [Platform -]-pattern. I've tried to use several configurations and when I'm matching against this pattern it breaks correctly, but I still get stack traces which are on multiple lines like in the attachment.

We're using NLog for logging.

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

Looks to me like the beginning of all of your events has the following pattern:

<ddd>Timestamp .....

So I would try something like this

[MySourceTypeHere]
 SHOULD_LINEMERGE = false
 LINE_BREAKER = ^<\d{3}>
0 Karma

Saasen
New Member

This only removes the pattern (^<\d{3}>) from the event like this:

May 12 07:25:48 NOQ06WS0104:    at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
May 12 07:25:48 NOQ06WS0104: --- End of stack trace from previous location where exception was thrown ---
May 12 07:25:48 NOQ06WS0104:    at System.Web.Http.WebHost.HttpControllerHandler.&lt;ProcessRequestAsyncCore&gt;d__0.MoveNext()
May 12 07:25:48 NOQ06WS0104:    at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
May 12 07:25:48 NOQ06WS0104:    at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
May 12 07:25:48 NOQ06WS0104:    at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
May 12 07:25:48 NOQ06WS0104: --- End of stack trace from previous location where exception was thrown ---
May 12 07:25:48 NOQ06WS0104:    at System.Web.Http.WebHost.HttpControllerHandler.&lt;CopyResponseAsync&gt;d__7.MoveNext()

This didn't help at all. Could it be that the logger is firing multiple events per CRLF?

0 Karma

esix_splunk
Splunk Employee
Splunk Employee
[MySourceTypeHere]
  SHOULD_LINEMERGE = true
  BREAK_ONLY_BEFORE = ^&lt;d{3}&gt;

Try that one..

0 Karma

Saasen
New Member

That should've worked. I agree on you with that. However, it does nothing. It seems like each stack trace line is one individual event. Maybe it's not possible to merge these?

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

You might need to adjust the :

MAX_EVENTS =

Setting in props.conf. Default is 256, but your sample events should fall under that.

Have you tried the Data Onboarding wizard in Splunk?

0 Karma

woodcock
Esteemed Legend

Try this in props.conf:

[MySourceTypeHere]
SHOULD_LINEMERGE = false
LINE_BREAKER = (End of stack trace from previous location where exception was thrown ---)([\r\n]+)
0 Karma

Saasen
New Member

I tried your configuration. However, it seems like the message only disappeared and the stack trace is still on multiple lines. It seems like I can't attach more files due to low point count. I can paste in the result here:

 &lt;187&gt;May 12 07:25:48 NOQ06WS0104:    at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
 &lt;187&gt;May 12 07:25:48 NOQ06WS0104: --- 
 &lt;187&gt;May 12 07:25:48 NOQ06WS0104:    at System.Web.Http.WebHost.HttpControllerHandler.&lt;ProcessRequestAsyncCore&gt;d__0.MoveNext()
 &lt;187&gt;May 12 07:25:48 NOQ06WS0104:    at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
 &lt;187&gt;May 12 07:25:48 NOQ06WS0104:    at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
 &lt;187&gt;May 12 07:25:48 NOQ06WS0104:    at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
 &lt;187&gt;May 12 07:25:48 NOQ06WS0104: --- 
 &lt;187&gt;May 12 07:25:48 NOQ06WS0104:    at System.Web.Http.WebHost.HttpControllerHandler.&lt;CopyResponseAsync&gt;d__7.MoveNext()

The stack trace is still on multiple lines, but I can't understand why.

0 Karma

woodcock
Esteemed Legend

Did you use SHOULD_LINEMERGE = false? If you did not use this or if you used true it will not work correctly. Also, if you would like to not remove the (IMHO, useless, once linebreaking is working) text, then remove the first set of parentheses (just the "(" and ")" chars, not the text between it). This should definitely work.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...