Splunk Error Log Dashboard

StackOverflow https://stackoverflow.com/questions/7477751

  •  23-01-2021
  •  | 
  •  

Question

I've to create a dashboard in splunk which will show error reporting within the log file:

[2011-09-12 14:13:00:605 GMT][com.abc.rest.Security][http-8080-Processor15] ERROR Unable to decrypt token [abc.com=3502639832.36895.0000; path=/] due to error: Input length must be multiple of 16 when decrypting with padded cipher
[2011-09-12 14:13:00:608 GMT][com.abc.filters.AuthenticationFilter][http-8080-Processor15] DEBUG ValidAuthToken: false
[2011-09-13 16:43:40:134 GMT][com.abc.PerfManager][http-8080-Processor13] ERROR Operation Failed: GET_ACCOUNT_ORDER [Status Code: 0150 Message: ACCESS_DENIED]
[2011-09-13 16:43:40:137 GMT][com.abc.rest.ResolvePackage][http-8080-Processor13] WARN MCE error occurred [StatusCode: 0150].

The above errors are occurring at different times & I want to count those all & show pie chart of all these errors with their count. Basically, these errors could be anything which starts with ERROR.

I should also get the Top10 warnings in the logs with their count.

I couldn't find a good way to implement it in Splunk. Can any one help me out on how to implement it in splunk?

Thanks!

Was it helpful?

Solution

... | rex "ERROR (?<error_type>[^\[]+)" | stats count by error_type

something like that should work. check our http://splunk-base.splunk.com/answers/ if it doesn't work.

Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top