Create table of exception

[harishd]

Hi,

I have tried to list out all the tomcat exceptions from my application logs like this.

host="Tom1" sourcetype="out" | rex field=_raw "\b(?(java|javax).[\w.]+Exception)" | chart count by exception_type

However I am able to do this only for one single host. But I need something like this.

Exception                        host1          host2           host4 ......
java.net.exception                32             4               54
javax.nullpointerexception        34             56              34
java.netcommandException          34             34              22

How can I achieve this.

Regards,
Harish

[Ayn · Accepted solution]

Just add another by directive to chart:

sourcetype="out" 
| rex field=_raw "b(?<exception_type>(java|javax).[w.]+Exception)" 
| chart count by exception_type,host

[dwaddle]

If this answer solved your problem, please make sure to click the "accepted" check-mark next to it so it gets marked as "answered". Thanks.

[harishd]

Cool thanks a lot.

splunk is really awesome and you guys too..

Regards,
Harish