Dashboards & Visualizations

Creating a table, but it shows 3 column error msg?


I am trying to create a table which shows 3 column error msg, errorcode, and count. my current query is pulling the errorcode/msg in one column and error count  individually instead of whole. Please assist.

my Current Query

My current queryMy current query






Current Output

Screen Shot 2022-05-09 at 8.46.04 PM.png

Expected Output

Screen Shot 2022-05-09 at 8.52.59 PM.png

Labels (3)
0 Karma


@Khanu89 - It's actually an issue with regex (rex) extracting ErrorCode, that it is extracting ErrorCode and error message everything in a single field.

You can try extracting them separately and then you can update your stats to add the error_msg field in the groupby (or by).


I hope this helps!!!



@VatsalJagani  Thank you for your input. Can you please elaborate on how can I extract separately?

Tags (1)
0 Karma

| rex field=_raw "%\s(?<ErrorCode>\d+)\s(?<error_msg>.*)\s"


And then you can use 

| stats ..... by ErrorCode, error_msg


something like this. Regex could not be valid for all the use cases, I'm just seeing a few examples from the screenshot.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...