Splunk Search

How Can I get a table of distinct errors?

aohls
Contributor

I am looking to create a table for distinct errors we have. Unfortunately I had this working at one point and am unable to recreate it and didn't save it. I have the following string, "Error - (Some text explaining the error)". I was doing the following to pull the variable for the error string: rex field=_raw "Error - \|(?<ErrorString>\d+)"

I am looking to create a table with the server, distinct error string, count of total occurrences of the error on the specified server. Currently when I try to add my ErrorString field, I get the number of events from my search but each field is blank.

1 Solution

rphillips_splk
Splunk Employee
Splunk Employee

From your description it sounds like you might be after a search like:

...|rex field=_raw "Error - \|(?<ErrorString>\d+)" | stats count by host ErrorString

View solution in original post

0 Karma

rphillips_splk
Splunk Employee
Splunk Employee

From your description it sounds like you might be after a search like:

...|rex field=_raw "Error - \|(?<ErrorString>\d+)" | stats count by host ErrorString

0 Karma

aohls
Contributor

My error string is multiple words, is there a way to specify the rex to go a certain length and not stop at the first word?

0 Karma

DalJeanis
Legend

If you wanted up to 30 characters, you could go

|rex field=_raw "Error - \|(?<ErrorString>.{1,30})"
0 Karma

DalJeanis
Legend

Given the data, I don't see the reason for the escaped pipe \| in your rex. try deleting that and seeing if the rex works again.

0 Karma

adonio
Ultra Champion

maybe this:

your search | rex field=_raw "Error - |(?\d+)"
| stats count as error_count dc(ErrorString) as ErrString by server

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...