search-time-field-extraction

Tomcat Response errors HTTP/HTTPS requests have over 200 errors within a 10 second period of time (we may want to consider tuning this, but let’s see what 200 alerts on now. sourcetype="tomcat:access:log" | bucket _time span=10s | rex field=_raw "(?ms)^[^\"\\n]*\"(?P<firstLineofRequest>[^\"]+)\"\\s+(?P<httpStatusCode>\\d+)\\s+(?P<bytesSentCount>[^ ]+)" | search httpStatusCode>399 | stats count(httpStatusCode) AS STCount | search STCount>200 HTTP/HTTPS requests do not respond after 10 seconds sourcetype="tomcat:access:log" | bucket _time span=10s | rex field=_raw "(?ms)^[^\"\\n]*\"(?P<firstLineofRequest>[^\"]+)\"\\s+(?P<httpStatusCode>\\d+)\\s+(?P<bytesSentCount>[^ ]+)" | search httpStatusCode>0 | stats count(httpStatusCode) AS STCount | search STCount<0

Continue Reading...