Hi,
I have tried to list out all the tomcat exceptions from my application logs like this.
host="Tom1" sourcetype="out" | rex field=_raw "\b(?
However I am able to do this only for one single host. But I need something like this.
Exception host1 host2 host4 ......
java.net.exception 32 4 54
javax.nullpointerexception 34 56 34
java.netcommandException 34 34 22
How can I achieve this.
Regards,
Harish
Just add another by
directive to chart
:
sourcetype="out"
| rex field=_raw "b(?<exception_type>(java|javax).[w.]+Exception)"
| chart count by exception_type,host
Just add another by
directive to chart
:
sourcetype="out"
| rex field=_raw "b(?<exception_type>(java|javax).[w.]+Exception)"
| chart count by exception_type,host
If this answer solved your problem, please make sure to click the "accepted" check-mark next to it so it gets marked as "answered". Thanks.
Cool thanks a lot.
splunk is really awesome and you guys too..
Regards,
Harish