Splunk Search

Extracting unique Null Pointer Exception from the logs via Splunk

ashirgao
New Member

I am looking to extract unique NullPointerException from the Splunk Logs. Unfortunately somehwere my regex is isnt extracting correctly.

Any input would be helpful.

Exception from the logs :

2018-10-24 20:19:09,664 DEBUG ExceptionHandlerExceptionResolver:133 - Resolving exception from handler [public com.json.SaveResponse com.controller.UIController.saveCoreScreen(javax.servlet.http.HttpServletRequest) throws java.lang.Exception]: java.lang.NullPointerException
2018-10-24 20:19:09,664 DEBUG DefaultListableBeanFactory:251 - Returning instance of 'globalExceptionHandler'
2018-10-24 20:19:09,664 ERROR GlobalExceptionHandler:134 - Generic Core Config Excpetion
java.lang.NullPointerException
at sun.reflect.GeneratedMethodAccessor2704.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)

I want my splunk queries to extract only NullPointerException with

2018-10-24 20:19:09,664 ERROR GlobalExceptionHandler:134 - Generic Core Config Excpetion
 java.lang.NullPointerException
at sun.reflect.GeneratedMethodAccessor2704.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)

and not the one with

2018-10-24 20:19:09,664 DEBUG ExceptionHandlerExceptionResolver:133 - Resolving exception from handler [public com.json.SaveResponse com.controller.UIController.saveCoreScreen(javax.servlet.http.HttpServletRequest) throws java.lang.Exception]: java.lang.NullPointerException

The thing that differentiate is it

ERROR term with the NullPointerException logs.

Any suggestion how could build with regex with it.

Thanks !

0 Karma

FrankVl
Ultra Champion

What did you try so far that didn't work?

Do you want to ingest all these events into splunk but only define extractions for the ERROR events, or do you want to filter out the DEBUG events altogether and only ingest the ERROR logs into Splunk?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...