topic Re: Create table of exception in Splunk Search

Create table of exception

harishd — Mon, 28 Sep 2020 09:45:22 GMT

Hi,

I have tried to list out all the tomcat exceptions from my application logs like this.

host="Tom1" sourcetype="out" | rex field=_raw "\b(?(java|javax).[\w.]+Exception)" | chart count by exception_type

However I am able to do this only for one single host. But I need something like this.

Exception                        host1          host2           host4 ......
java.net.exception                32             4               54
javax.nullpointerexception        34             56              34
java.netcommandException          34             34              22

How can I achieve this.

Regards,
Harish

Re: Create table of exception

Ayn — Mon, 25 Jul 2011 12:24:32 GMT

Just add another by directive to chart:

sourcetype="out" 
| rex field=_raw "b(?<exception_type>(java|javax).[w.]+Exception)" 
| chart count by exception_type,host

Re: Create table of exception

harishd — Tue, 26 Jul 2011 06:15:27 GMT

Cool thanks a lot.

splunk is really awesome and you guys too..

Regards,
Harish

Re: Create table of exception

dwaddle — Wed, 27 Jul 2011 14:10:07 GMT

If this answer solved your problem, please make sure to click the "accepted" check-mark next to it so it gets marked as "answered". Thanks.