Splunk Search

Question on how to use the lookup file for Exception monitoring

Deepz2612
Explorer

I have a lookup file which has below coloumns.

Exception_Name Exception_Keyword Comments
REXC RemoteException Alerted
JNEXC Exception-NullPointer Ignorable

Now in the logs when the Exception_Keyword occurs,It should look for the lookupfile and take the Exception_Name,Comments and give the result with host and count also.
And if the Exception_Keyword does not exists in lookup it should be listed as New..and when clicking on New it should show me all the new exceptions(_raw events)

Expected output as below :

Exception_Name Exception_Keyword Host count
REXC RemoteException XYZ 67
New soapexception ABC 3

Further drilling down to the New exception It should show me this list of it..Same with others also.

0 Karma

Deepz2612
Explorer

Can someone help me with this please

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...