How to get db connect exception with timestamp via query

[Marta88]

Hi,

I am looking for a query to get list of DBConnect exceptions with their timestamp in order to plot them in a graph.

Thank you

Kind regards

Marta

[ITWhisperer]

What events do you have ingested into Splunk showing this condition?

[Marta88]

Splunk is logging something in the index=_internal. For instance if I run "index=_internal dbconnect" I see something but I am not sure that this is the exact query.

[ITWhisperer]

Are the events you are interested in returned by this search?

Do you need to filter further e.g. 

index=_internal dbconnect exception

[Marta88]

Actually the event I am interest in are not returned by this search. I noticed that this search is returning as event the query that I am doing.  Maybe I should search a different index.