Knowledge Management

Exceptions count different when compared to creating event types

New Member

Hi I am a new to splunk and need help with a query:

index=abc exception | rex ".?(?(?:\w+.)+\w*?Exception)."| stats count by exception
When I use the above query, I am getting a table of exceptions and its count listed, as below


Here in this case I am getting a event count for as 3 events occured.
I am trying to create an event type for this particular exception( to add it as a tag to a jira,

index=abc exception | rex ".?(?(?:\w+.)+\w?Exception).*"| search exception="java.lang.NullPointerException"
This above query cannot be saved as a event type, as its not accepting tubes "|"

When i try to search specifically for using the below query-
sourcetype=abc java.lang.NullPointerException*

I am getting an event count as 220 events occured

I am requesting some help to match the exact the event count numbers between my rex and event type query.

Tags (2)
0 Karma


Try these two searches

sourcetype=abc exception | rex "(?<exception>NullPointerException)"| stats count by exception


sourcetype=abc java.lang.NullPointerException*
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!