Dashboards & Visualizations

Is that possible that multiple rows can come in one Incident from splunk


Hi Everyone,

Is that possible that we can send multiple row in one incident.

My search query is below:

index=abc ns=blazegateway ("NullPointerException" OR "IllegalStateException" OR "RuntimeException" OR "NumberFormatException" OR "NoSuchMethodException" OR "ClassCastException" OR "ParseException" OR "InvocationTargetException" OR "OutOfMemoryError")| rex "message=(?<ExceptionMessage>[^\n]+)"|eval _time = strftime(_time,"%Y-%m-%d %H:%M:%S.%3N")|cluster showcount=t t=0.9|table app_name, ExceptionMessage,cluster_count,_time, environment, pod_name,ns|dedup ExceptionMessage|rename app_name as APP_NAME, _time as Time, environment as Environment, pod_name as Pod_Name,cluster_count as Count


so I am getting 5(It can be more based on result) rows with different Exception messges.

I want that all 5 rows should be there in one incident.

But I am getting only first row fields 

Is that possible that all 5 rows will be in one incident

Labels (2)
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!