Splunk query to extract JSP from stack trace in error log

We used what is below to parse through stack traces that had been logged in JBOSS. We were looking for the page most frequently impacted by a persistent transaction blocking issue.

host=cmhlpecomecm* (ORA-00060 OR ORA-02049) AND org.apache.jsp 
  | rex field=_raw "(?(?m)org.apache.jsp.*?\()" 
  | stats count by page

This will show output with counts for the first line (from the top) in a given call stack. This is the page that triggered the exception.


Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.