Splunk Search

How to get the distinct count of the number of "Errors" or "Exceptions"?

jw44250
New Member

I have used this following Splunk search, but the output result is not correct. I am using OR operator for either Error or Exception, but i need only Exception but not Error. But sometimes Error and Exception can appear at the same. And sometimes only Error appears.

(index=index1) ("Error") OR (*Exception*)  | rex ".*?(?(?:\w+\.)+\w*?Exception).*" | stats count by  index,sourcetype , exception

The following cases:

Case1. The Error and Exception happened at the same time -- only count Exception, exclude Error

// Result 
// Error this was test error... java....ClassCastException

Case2. The Error happened only -- only count Error

// Result 
// Error this message from hr_test 

Case3. The Exception happened only -- only count Exception
// result

// java.io.FileNotFoundException

Thanks in advance your assistance

Tags (2)
0 Karma

skoelpin
SplunkTrust
SplunkTrust

This will accomplish what you're looking for. This will give a distinct count of exceptions with Error and Exception OR just Exception.. I also think your rex command is wrong as there's no Splunk name defined in the capture group..

index=index1 (Error AND Exception) OR "Exception" | rex ".?(?(?:\w+.)+\w?Exception).*" | stats dc(Exception) by index,sourcetype , exception

0 Karma

jw44250
New Member

still the total count for exception is not correct -- i want to use IN operator something like this

index=index* . EXception IN(NPE, SQLNotFOund, FILE) |stats count by exception...

The query does but its counts all the exception which is the same log...i am not interest the word exception at all

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...