I am looking to extract unique NullPointerException from the Splunk Logs. Unfortunately somehwere my regex is isnt extracting correctly.
Any input would be helpful.
Exception from the logs :
2018-10-24 20:19:09,664 DEBUG ExceptionHandlerExceptionResolver:133 - Resolving exception from handler [public com.json.SaveResponse com.controller.UIController.saveCoreScreen(javax.servlet.http.HttpServletRequest) throws java.lang.Exception]: java.lang.NullPointerException
2018-10-24 20:19:09,664 DEBUG DefaultListableBeanFactory:251 - Returning instance of 'globalExceptionHandler'
2018-10-24 20:19:09,664 ERROR GlobalExceptionHandler:134 - Generic Core Config Excpetion
java.lang.NullPointerException
at sun.reflect.GeneratedMethodAccessor2704.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
I want my splunk queries to extract only NullPointerException with
2018-10-24 20:19:09,664 ERROR GlobalExceptionHandler:134 - Generic Core Config Excpetion
java.lang.NullPointerException
at sun.reflect.GeneratedMethodAccessor2704.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
and not the one with
2018-10-24 20:19:09,664 DEBUG ExceptionHandlerExceptionResolver:133 - Resolving exception from handler [public com.json.SaveResponse com.controller.UIController.saveCoreScreen(javax.servlet.http.HttpServletRequest) throws java.lang.Exception]: java.lang.NullPointerException
The thing that differentiate is it
ERROR term with the NullPointerException logs.
Any suggestion how could build with regex with it.
Thanks !
What did you try so far that didn't work?
Do you want to ingest all these events into splunk but only define extractions for the ERROR events, or do you want to filter out the DEBUG events altogether and only ingest the ERROR logs into Splunk?