Splunk Search

Filter access log by time of exceptions in syslog with splunk

staffang
New Member

I have a log4j syslog which throws a few nullpointers every day like:

2015-10-05 00:00:53,042 ERROR DefaultExceptionMapper - Unexpected error occurred
java.lang.NullPointerException
    at some.java.code.of.mine(SomeJavaFileOfMine.java:318)`

I am having some thoughts about these calls being from google-bots indexing the webpage and I would hence like to figure out which IP-adresses that are causing these exceptions by comparing the time of the exception with the times in our access logs.

An event in the access log looks something like:

2XX.1XX.XXX.XXX - - [05/Oct/2015:10:48:02 +0200] 
"GET SOMETHING HTTP/1.1" 200 31912 "SOME URL" 
"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:41.0) 
Gecko/20100101 Firefox/41.0" www.someurl.com SOME_STAT_COOKIE_ID=-

How do I do to get a list of the ip-adresses which are making requests at all of times certain exceptinos occur in my syslog?

I have tried with the following Splunk-query but with no results:

source="access_log" | eval timez=strftime(_time, "%H:%M %m-%d-%y") | search [search source="frontend.log" SomeJavaFileOfMine "java.lang.NullPointerException" | eval timez=strftime(_time, "%H:&M %m-%d-%y") | fields timez]
Tags (1)
0 Karma

woodcock
Esteemed Legend

Like this:

search source="frontend.log" SomeJavaFileOfMine "java.lang.NullPointerException" | eval exceptionTime = _time | map search="search earliest=$exceptionTime$ latest=$exceptionTime$ source="access_log | stats count by IPAddressFieldName"
0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...