https://community.splunk.com/t5/Splunk-Search/How-to-create-regular-expressions-for-these-Exceptions/m-p/277593#M83712 <P>try like this:</P> <P>|stats c | eval _raw ="javax.ejb.NoSuchEJBException"|append[|stats c | eval _raw ="java.lang.Exception"] |append[|stats c | eval _raw ="javax.faces.application.ViewExpiredException"]| rex "(?^(java)x?.[.\w]+)"|stats c by exp</P> Mon, 06 Feb 2017 07:54:41 GMT mpreddy 2017-02-06T07:54:41Z https://community.splunk.com/t5/Splunk-Search/How-to-create-regular-expressions-for-these-Exceptions/m-p/277588#M83707 <P>I want to know how can i create regular expressions for the following exceptions...</P> <PRE><CODE>java.io.IOException java.lang.Exception java.lang.IllegalAccessException java.lang.reflect.InvocationTargetException java.lang.RuntimeException java.net.ConnectException, java.net.SocketException java.rmi.NoSuchObjectException java.util.MissingResourceException javax.ejb.NoSuchEJBException javax.faces.application.ViewExpiredException javax.faces.FacesException </CODE></PRE> Sun, 05 Feb 2017 16:43:32 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-regular-expressions-for-these-Exceptions/m-p/277588#M83707 jw44250 2017-02-05T16:43:32Z https://community.splunk.com/t5/Splunk-Search/How-to-create-regular-expressions-for-these-Exceptions/m-p/277589#M83708 <P>Here's one regex string. There may be others.</P> <PRE><CODE>javax?\.[\.\w]+Exception </CODE></PRE> Sun, 05 Feb 2017 20:36:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-regular-expressions-for-these-Exceptions/m-p/277589#M83708 richgalloway 2017-02-05T20:36:28Z https://community.splunk.com/t5/Splunk-Search/How-to-create-regular-expressions-for-these-Exceptions/m-p/277590#M83709 <P>Not working @richgalloway.. im new to splunk</P> <P>index=index* | rex field="javax?.[.\w]+Exception" |stats count<BR /> Result<BR /> Error in 'SearchOperator:rex': Usage: regex [field=] </P> Sun, 05 Feb 2017 21:14:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-regular-expressions-for-these-Exceptions/m-p/277590#M83709 jw44250 2017-02-05T21:14:56Z https://community.splunk.com/t5/Splunk-Search/How-to-create-regular-expressions-for-these-Exceptions/m-p/277591#M83710 <P>The syntax is incorrect and you need a capturing group. Try <CODE>index=index* | rex "(?&lt;Exception&gt;javax?.[.\w]+Exception)" |stats count</CODE>.</P> Sun, 05 Feb 2017 22:46:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-regular-expressions-for-these-Exceptions/m-p/277591#M83710 richgalloway 2017-02-05T22:46:06Z https://community.splunk.com/t5/Splunk-Search/How-to-create-regular-expressions-for-these-Exceptions/m-p/277592#M83711 <P>something like i think</P> <P>rex field=_raw "port (?</P> Sun, 05 Feb 2017 22:54:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-regular-expressions-for-these-Exceptions/m-p/277592#M83711 jw44250 2017-02-05T22:54:53Z https://community.splunk.com/t5/Splunk-Search/How-to-create-regular-expressions-for-these-Exceptions/m-p/277593#M83712 <P>try like this:</P> <P>|stats c | eval _raw ="javax.ejb.NoSuchEJBException"|append[|stats c | eval _raw ="java.lang.Exception"] |append[|stats c | eval _raw ="javax.faces.application.ViewExpiredException"]| rex "(?^(java)x?.[.\w]+)"|stats c by exp</P> Mon, 06 Feb 2017 07:54:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-regular-expressions-for-these-Exceptions/m-p/277593#M83712 mpreddy 2017-02-06T07:54:41Z https://community.splunk.com/t5/Splunk-Search/How-to-create-regular-expressions-for-these-Exceptions/m-p/277594#M83713 <P>This works:</P> <PRE><CODE>|rex field=_raw "\s(?&lt;a_exceptiontype&gt;(java|javax)\.\w+\.\w+Exception)" </CODE></PRE> <P>Tested.</P> Mon, 06 Feb 2017 09:11:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-regular-expressions-for-these-Exceptions/m-p/277594#M83713 mirkoneverstops 2017-02-06T09:11:11Z