Splunk Search

how to search a list with *Exceptions

vincenty
Explorer

I want to search from a list of the following *Exceptions from log files. I don't have a field defined nor know how to define it. I want get a table report with number of occurrences for each type of exceptions. I think I may be able to do it with inputlookup but not sure how to get started.... please help

com.sun.jersey.api.client.ClientHandlerException

org.eclipse.persistence.exceptions.OptimisticLockException

Locks.checkThreadStopException

com.sun.xml.ws.client.ClientTransportException

java.io.IOException

java.lang.Exception

java.lang.IllegalAccessException

java.lang.reflect.InvocationTargetException
java.lang.RuntimeException
java.net.ConnectException,
java.net.SocketException
java.rmi.NoSuchObjectException

java.util.MissingResourceException

javax.ejb.NoSuchEJBException

javax.faces.application.ViewExpiredException
javax.faces.FacesException

javax.mail.MessagingException
...

Tags (1)
0 Karma

jonuwz
Influencer

Try this for a starter

Exception | rex ".*?(?<exception>(?:\w+\.)+\w*?Exception).*"
          | stats count by exception

acveer
Engager

Thank you. this worked for me.

0 Karma

vincenty
Explorer

ok thx. Can use the patterns as you've provided to search with the following. Is there a easier way to do this especially if I add another level?

Exception | rex "(?:^|\s)(?\w+.\w+.\w+.\w+Exception)(?:\s|$)" | search Exception | rex "(?:^|\s)(?\w+.\w+.\w+Exception)(?:\s|$)" |stats count by exception

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...