Splunk Search

How to capture type of events in fields based on single event type?

raj_mpl
Path Finder

Hi All ,
1)How do you capture INFO/ERROR/WARN events using regular expression ?
2)How do you capture the rest of the events not including INFO/ERROR/WARN events using regular expression ?
Sample log looks like this

[30/07/18 17:42:00:492 XXX] 00000056 SystemOut     O 30 Jul 2017 17:42:00:492 [INFO] [xxxxxx] [] xxxxx - The total memory is 411116 and the memory available is 2638295816.
[30/07/17 17:42:00:492 EST] 00000056 SystemOut     O 30 Jul 2017 17:42:00:492 [INFO] [xxxxxx] [] xxxxxxx - The total memory is 111111111 and the memory available is 2638295816.
[30/07/17 17:42:00:492 XXX] 00000056 SystemOut     O 30 Jul 2017 17:42:00:492 [INFO] [xxxxxx] [] xxxxxx - The total memory is 1111111 and the memory available is 2638295816.
[30/07/17 15:37:42:379 XXX] 00001db5 LdapConnectio I xxx.xxx.xx.xx.xxxxx.xxxx.xxxxxxxxxx  reCreateDirContext(String errorMessage) xxxxxxxxx The user registry is now connected to 'xxxxxxxxxxxxxx' LDAP Server.
[30/07/17 15:33:59:281 XXX] 0000xxxx0 SystemOut O Into the constructor of xxxxx

Thanks

0 Karma

Richfez
SplunkTrust
SplunkTrust

A regex like the one in the run-anywhere sample should do it.

| makeresults | eval _raw="[30/07/18 17:42:00:492 XXX] 00000056 SystemOut O 30 Jul 2017 17:42:00:492 [INFO] [xxxxxx] [] xxxxx - The total memory is 411116 and the memory available is 2638295816."
| rex "\[(?<log_level>(INFO|WARN|ERROR)[^\]]*)\](?<log_message>.*)"

The first line with makeresults and eval simple create a log line like yours is.
The second line is the rex, which creates a field "log_level" from your INFO, WARN or ERROR portion and "log_message" from all that's left to the end.

Happy Splunking,
Rich

0 Karma

Richfez
SplunkTrust
SplunkTrust

@raj_mpl - sorry, I edited your "answer" and put it as a comment under this answer, because that's where it belongs, but .. somehow it got deleted? Well, no matter - I apologize, but I remember the question so I'll just add some answer here.

To get some statistics, I'd use either timechart or stats. For instance,

<your base search> 
| rex "\[(?<log_level>(INFO|WARN|ERROR)[^\]]*)\](?<log_message>.*)"
| timechart count by log_level

or

<your base search> 
| rex "\[(?<log_level>(INFO|WARN|ERROR)[^\]]*)\](?<log_message>.*)"
| stats count by log_level

the by log_level could be by log_level, host, or almost any other thing. Play with those two options and some variants and see where that gets you.

For reference:
The Splunk docs on stats
The Splunk docs on timechart

0 Karma

raj_mpl
Path Finder

Hi @rich7177 thank you for your response , the query you have provided works fine ,can you give me a query to build same statistics for all the events in my log more than 2000+ each day

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...