I have used this following Splunk search, but the output result is not correct. I am using OR operator for either Error or Exception, but i need only Exception but not Error. But sometimes Error and Exception can appear at the same. And sometimes only Error appears.
(index=index1) ("Error") OR (*Exception*) | rex ".*?(?(?:\w+\.)+\w*?Exception).*" | stats count by index,sourcetype , exception
The following cases:
Case1. The Error and Exception happened at the same time -- only count Exception, exclude Error
// Result // Error this was test error... java....ClassCastException
Case2. The Error happened only -- only count Error
// Result // Error this message from hr_test
Case3. The Exception happened only -- only count Exception
Thanks in advance your assistance
This will accomplish what you're looking for. This will give a distinct count of exceptions with Error and Exception OR just Exception.. I also think your rex command is wrong as there's no Splunk name defined in the capture group..
index=index1 (Error AND Exception) OR "Exception" | rex ".?(?(?:\w+.)+\w?Exception).*" | stats dc(Exception) by index,sourcetype , exception
still the total count for exception is not correct -- i want to use IN operator something like this
index=index* . EXception IN(NPE, SQLNotFOund, FILE) |stats count by exception...
The query does but its counts all the exception which is the same log...i am not interest the word exception at all