topic Re: Count Exceptions without any field usage. in Splunk Enterprise

How to count Exceptions without any field usage?

Kk — Thu, 17 Mar 2022 15:43:43 GMT

Hi All, Can we retrieve the Exception count without any predefined field or without creating any field. Basically,I just want each Exception count in table where row is Exception name and count is the column. Consider Exceptions are Nullpointer, IllegalArgument etc..

Pls comment out the query that will be helpful.

Re: Count Exceptions without any field usage.

ITWhisperer — Thu, 17 Mar 2022 15:17:49 GMT

You could extract the exception from the _raw event field and base your counts on that.

Re: Count Exceptions without any field usage.

Kk — Thu, 17 Mar 2022 15:41:07 GMT

No just assume I gave you already known Exceptions like I mentioned above there. So for that how can we show the count of each and every Exception in table. Here we have only strings i.e Exception names which are not extracted to field in common. With that, I have to generate a table row as an exception name and col as count.

Pls make sure there is no common field extraction.

Re: Count Exceptions without any field usage.

ITWhisperer — Thu, 17 Mar 2022 15:47:49 GMT

... your search | rex "(?<exception>Nullpointer|IllegalArgument|etc)" | stats count by exception