Alerting

How to configure my email alert to exclude results?

super_virus
New Member

Hi ,

I have set up alerting on Java exceptions:

My search string:

index=myapp_logs source=/opt/man/myapp/myapp.log exception=java*

The above search emails us when a threshold for no of exceptions is met.

I need Spunk to exclude some specific exceptions, Spunk should ignore these multiple exceptions.

java.test.IllegArgumentException
java.test.IllegArgumentException
javat.persistence.testException

How do i get this done?

0 Karma
1 Solution

gokadroid
Motivator

Can you not try to modify the initial search to exclude the strings that you do not require as a start, something like:

index=myapp_logs source=/opt/man/myapp/myapp.log exception=java* NOT ( exception=java*IllegArgumentException OR exception=javat.persistence.testException)

OR if you do some multivalued extractions from where these exception strings are extracted then close the SPL with | search exception!=java*IllegArgumentException and so on.

View solution in original post

gokadroid
Motivator

Can you not try to modify the initial search to exclude the strings that you do not require as a start, something like:

index=myapp_logs source=/opt/man/myapp/myapp.log exception=java* NOT ( exception=java*IllegArgumentException OR exception=javat.persistence.testException)

OR if you do some multivalued extractions from where these exception strings are extracted then close the SPL with | search exception!=java*IllegArgumentException and so on.

super_virus
New Member

Thanks ! this works.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...