How to count Exceptions without any field usage?

[Kk]

• Hi All, Can we retrieve the Exception count without any predefined field or without creating any field. Basically,I just want each Exception count in table where row is Exception name and count is the column. Consider Exceptions are Nullpointer, IllegalArgument etc..

Pls comment out the query that will be helpful.

[ITWhisperer]

You could extract the exception from the _raw event field and base your counts on that.

[Kk]

No just assume I gave you already known Exceptions like I mentioned above there. So for that how can we show the count of each and every Exception in table. Here we have only strings i.e Exception names which are not extracted to field in common. With that, I have to generate a table row as an exception name and col  as count.

Pls make sure there is no common field extraction.

[ITWhisperer · Accepted solution]

... your search
| rex "(?<exception>Nullpointer|IllegalArgument|etc)"
| stats count by exception