Create table for exception without key-value pair

[shilpi]

I am new to Splunk.

I need to search my logs for any Exception (FileNotFoundException in below example) and then populate the data in a table with 2 columns- host and the exception. The exception is not in key-value format. A sample of my log file is-

2011-06-24 13:29:39,453 [J353454535 c:1.5.7.88] INFO  (MyClass.java:78) - FileNotFoundException
host=myhost.google.com   Options|  sourcetype=My_log4j   

[MHibbin]

You should look at creating your fields first:

http://docs.splunk.com/Documentation/Splunk/5.0.3/Knowledge/Addfieldsatsearchtime

However the following should (I think) provide what you require (assuming the format is always the same for exceptions):

<yourBaseSearch>
| rex field=_raw "\-\s+(?P<exception>\w+)"
| table host exception

In the above I just use rex to extract the field on the fly.

Hope this helps.