Getting Data In

Line breaking C# stack trace

Saasen
New Member

Hi.

I'm currently trying to get the stack trace in C# in one event, not in multiple events. Please look at the attachment.
Is there any way of doing this? I've messed around with the props.config a while, but I can't get it to work.

I've been trying to follow this article: http://blogs.splunk.com/2010/02/18/breaking-up-is-hard-to-do/.

The logfiles usually looks something like this:

<188>May 12 07:15:23 NOQ06WS0104: [Platform - WARN] 2015-05-12T07:15:23.279, { MD_Class="Web.Configuration.NLogLogger", Message="10s warning - due time is Monday, May 11, 2015 2:07:31 PM",  }, Ude.Shared.Logging.Logger.Log

<188>May 12 07:15:23 NOQ06WS0104: [Platform  - WARN] 2015-05-12T07:15:23.279, { MD_Class="Web.Configuration.NLogLogger", Message="10s warning - due time is Monday, May 11, 2015 2:07:31 PM",  }, Ude.Shared.Logging.Logger.Log

<188>May 12 07:15:23 NOQ06WS0104: [Platform - WARN] 2015-05-12T07:15:23.279, { MD_Class="Web.Configuration.NLogLogger", Message="10s warning - due time is Monday, May 11, 2015 2:07:31 PM",  }, Ude.Shared.Logging.Logger.Log

<187>May 11 15:09:06 NOQ06WS0104: [Platform - ERROR] 2015-05-11T15:09:06.761, { MD_Application="Unknown", MD_Class="Web.EPiServerApplication", Message=" Url: https://xxx.yyy.zz/Api/Facebook Controller: Facebook",  }, The operation was canceled.,    at System.Threading.CancellationToken.ThrowIfCancellationRequested()    at System.Web.Http.WebHost.HttpControllerHandler.<WriteBufferedResponseContentAsync>d__1b.MoveNext() --- End of stack trace from previous location where exception was thrown ---    at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()    at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)    at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)    at System.Web.Http.WebHost.HttpControllerHandler.<CopyResponseAsync>d__7.MoveNext() --- End of stack trace from previous location where exception was thrown ---    at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()    at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)    at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)    at System.Web.Http.WebHost.HttpControllerHandler.<ProcessRequestAsyncCore>d__0.MoveNext() --- End of stack trace from previous location where exception was thrown ---    at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()    at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)    at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)    at System.Web.TaskAsyncHelper.EndTask(IAsyncResult ar)    at System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()    at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously), Shared.Logging.Logger.Log

One line should contain the [Platform -]-pattern. I've tried to use several configurations and when I'm matching against this pattern it breaks correctly, but I still get stack traces which are on multiple lines like in the attachment.

We're using NLog for logging.

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

Looks to me like the beginning of all of your events has the following pattern:

<ddd>Timestamp .....

So I would try something like this

[MySourceTypeHere]
 SHOULD_LINEMERGE = false
 LINE_BREAKER = ^<\d{3}>
0 Karma

Saasen
New Member

This only removes the pattern (^<\d{3}>) from the event like this:

May 12 07:25:48 NOQ06WS0104:    at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
May 12 07:25:48 NOQ06WS0104: --- End of stack trace from previous location where exception was thrown ---
May 12 07:25:48 NOQ06WS0104:    at System.Web.Http.WebHost.HttpControllerHandler.&lt;ProcessRequestAsyncCore&gt;d__0.MoveNext()
May 12 07:25:48 NOQ06WS0104:    at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
May 12 07:25:48 NOQ06WS0104:    at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
May 12 07:25:48 NOQ06WS0104:    at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
May 12 07:25:48 NOQ06WS0104: --- End of stack trace from previous location where exception was thrown ---
May 12 07:25:48 NOQ06WS0104:    at System.Web.Http.WebHost.HttpControllerHandler.&lt;CopyResponseAsync&gt;d__7.MoveNext()

This didn't help at all. Could it be that the logger is firing multiple events per CRLF?

0 Karma

esix_splunk
Splunk Employee
Splunk Employee
[MySourceTypeHere]
  SHOULD_LINEMERGE = true
  BREAK_ONLY_BEFORE = ^&lt;d{3}&gt;

Try that one..

0 Karma

Saasen
New Member

That should've worked. I agree on you with that. However, it does nothing. It seems like each stack trace line is one individual event. Maybe it's not possible to merge these?

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

You might need to adjust the :

MAX_EVENTS =

Setting in props.conf. Default is 256, but your sample events should fall under that.

Have you tried the Data Onboarding wizard in Splunk?

0 Karma

woodcock
Esteemed Legend

Try this in props.conf:

[MySourceTypeHere]
SHOULD_LINEMERGE = false
LINE_BREAKER = (End of stack trace from previous location where exception was thrown ---)([\r\n]+)
0 Karma

Saasen
New Member

I tried your configuration. However, it seems like the message only disappeared and the stack trace is still on multiple lines. It seems like I can't attach more files due to low point count. I can paste in the result here:

 &lt;187&gt;May 12 07:25:48 NOQ06WS0104:    at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
 &lt;187&gt;May 12 07:25:48 NOQ06WS0104: --- 
 &lt;187&gt;May 12 07:25:48 NOQ06WS0104:    at System.Web.Http.WebHost.HttpControllerHandler.&lt;ProcessRequestAsyncCore&gt;d__0.MoveNext()
 &lt;187&gt;May 12 07:25:48 NOQ06WS0104:    at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
 &lt;187&gt;May 12 07:25:48 NOQ06WS0104:    at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
 &lt;187&gt;May 12 07:25:48 NOQ06WS0104:    at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
 &lt;187&gt;May 12 07:25:48 NOQ06WS0104: --- 
 &lt;187&gt;May 12 07:25:48 NOQ06WS0104:    at System.Web.Http.WebHost.HttpControllerHandler.&lt;CopyResponseAsync&gt;d__7.MoveNext()

The stack trace is still on multiple lines, but I can't understand why.

0 Karma

woodcock
Esteemed Legend

Did you use SHOULD_LINEMERGE = false? If you did not use this or if you used true it will not work correctly. Also, if you would like to not remove the (IMHO, useless, once linebreaking is working) text, then remove the first set of parentheses (just the "(" and ")" chars, not the text between it). This should definitely work.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...