Knowledge Management

Exceptions count different when compared to creating event types

girishgene07
New Member

Hi I am a new to splunk and need help with a query:

index=abc exception | rex ".?(?(?:\w+.)+\w*?Exception)."| stats count by exception
When I use the above query, I am getting a table of exceptions and its count listed, as below

com.system.enterprise.client.arcti.GeneralDomainCallException
java.land.NullPointerException
java.lang.RuntimeException
java.lang.reflect.InvocationTargetException

Here in this case I am getting a event count for java.land.NullPointerException as 3 events occured.
I am trying to create an event type for this particular exception(java.land.NullPointerException) to add it as a tag to a jira,

index=abc exception | rex ".?(?(?:\w+.)+\w?Exception).*"| search exception="java.lang.NullPointerException"
This above query cannot be saved as a event type, as its not accepting tubes "|"

When i try to search specifically for java.land.NullPointerException using the below query-
sourcetype=abc java.lang.NullPointerException*

I am getting an event count as 220 events occured

I am requesting some help to match the exact the event count numbers between my rex and event type query.

Tags (2)
0 Karma

sundareshr
Legend

Try these two searches

sourcetype=abc exception | rex "(?<exception>NullPointerException)"| stats count by exception

AND

sourcetype=abc java.lang.NullPointerException*
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...