A tabular report on list of unique exceptions and # of occurrences

[vincenty]

Hi I'm new to splunk.
I want to search "exception" over a lot of different types of log files with a return of a tabular report on list of unique exceptions and # of occurrences.

I tried to do this:
exception | dedup source | timechart count by source

this will give me a time chart... how do I get this in a pie chart?

[parameshjava]

earliest=-7d source=".log" | rex "(?\w*Exception)" | chart count by exception usenull=f useother=f | sort count

Once results generated click on Visualization tab --> Select Pie in left menu.
Here,
earliest=-7d --> for last 7 days
source=".log" --> To search in a specific file
rex "(?\w*Exception)" --> To extract all exceptions, use (?:\w+.)+\w* instead of \w* for fully qualified exception name
chart count by exception --> to generate chart
usenull=f useother=f --> To avoid NULL and OTHER

[martin_mueller]

Replace timechart with chart, set visualization to pie.

[rsennett_splunk]

All of these concepts are covered nicely in the tutorial. You might want to run through that so you'll more easily see how to organize things for your needs. It's quite fun and doesn't take long.

http://docs.splunk.com/Documentation/Splunk/latest/Tutorial/WelcometotheSplunktutorial

[martin_mueller]

For that you first need to extract your exception string into a field, see http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Aboutfields

[vincenty]

There can be different exceptions appears in a log file: SQLException, MessagingException, IOException, etc.

As well as in different log file types: *.log, *.out

I would like to get both a tabular report and a pie chart for them. A tabular report list the number of each unique occurrences of the "exception" type, and its corresponding logfile type (a.log, b.out, c.log...)

A pie chart to show the top exceptions.

May be for a day, 7 day,... does this make sense?