I am new to Splunk.
I need to search my logs for any Exception (FileNotFoundException
in below example) and then populate the data in a table with 2 columns- host and the exception. The exception is not in key-value format. A sample of my log file is-
2011-06-24 13:29:39,453 [J353454535 c:1.5.7.88] INFO (MyClass.java:78) - FileNotFoundException
host=myhost.google.com Options| sourcetype=My_log4j
You should look at creating your fields first:
http://docs.splunk.com/Documentation/Splunk/5.0.3/Knowledge/Addfieldsatsearchtime
However the following should (I think) provide what you require (assuming the format is always the same for exceptions):
<yourBaseSearch>
| rex field=_raw "\-\s+(?P<exception>\w+)"
| table host exception
In the above I just use rex
to extract the field on the fly.
Hope this helps.