https://community.splunk.com/t5/Monitoring-Splunk/How-to-find-errors-reported-in-the-data-num-of-parser-errors/m-p/384993#M5969 <P>I'm interested in knowing what the errors are rather than their minute to minute count, because we need to narrow down what keeps causing the EC's to crash, and we need some sort of error event or something to start off investigation.</P> Fri, 12 Jul 2019 07:18:33 GMT cdhippen 2019-07-12T07:18:33Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-find-errors-reported-in-the-data-num-of-parser-errors/m-p/384991#M5967 <P>We've got some event collectors going down occasionally, and I've seen that their downtime appears to be tied very closely with high counts of data.num_of_parser_errors in introspection, but I'm having trouble finding these parser errors. I looked up index=_internal DateParserVerbose but I'm only seeing warnings in the time periods when these errors were reported and none of them are unhandled from what I can tell. </P> Wed, 30 Sep 2020 01:17:12 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-find-errors-reported-in-the-data-num-of-parser-errors/m-p/384991#M5967 cdhippen 2020-09-30T01:17:12Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-find-errors-reported-in-the-data-num-of-parser-errors/m-p/384992#M5968 <P>Why does this not work?</P> <PRE><CODE> index=_introspection AND data.num_of_parser_errors=* AND (ERR* OR FAIL* OR CANNOT OR TIMEOUT OR CRASH* OR WARN* OR UNABLE) </CODE></PRE> Thu, 11 Jul 2019 20:41:43 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-find-errors-reported-in-the-data-num-of-parser-errors/m-p/384992#M5968 woodcock 2019-07-11T20:41:43Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-find-errors-reported-in-the-data-num-of-parser-errors/m-p/384993#M5969 <P>I'm interested in knowing what the errors are rather than their minute to minute count, because we need to narrow down what keeps causing the EC's to crash, and we need some sort of error event or something to start off investigation.</P> Fri, 12 Jul 2019 07:18:33 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-find-errors-reported-in-the-data-num-of-parser-errors/m-p/384993#M5969 cdhippen 2019-07-12T07:18:33Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-find-errors-reported-in-the-data-num-of-parser-errors/m-p/384994#M5970 <P>This search doesn't find anything for the record. I added "NOT "INFO"" to the end of the search as well.</P> Fri, 12 Jul 2019 14:49:41 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-find-errors-reported-in-the-data-num-of-parser-errors/m-p/384994#M5970 cdhippen 2019-07-12T14:49:41Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-find-errors-reported-in-the-data-num-of-parser-errors/m-p/384995#M5971 <P>I would open a support case. Don't expect a good answer quickly because support is swamped.</P> Sat, 13 Jul 2019 22:16:09 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-find-errors-reported-in-the-data-num-of-parser-errors/m-p/384995#M5971 woodcock 2019-07-13T22:16:09Z