I have used this following Splunk search, but the output result is not correct. I am using OR operator for either Error or Exception, but i need only Exception but not Error. But sometimes Error and Exception can appear at the same. And sometimes only Error appears.
(index=index1) ("Error") OR (*Exception*) | rex ".*?(?(?:\w+\.)+\w*?Exception).*" | stats count by index,sourcetype , exception
The following cases:
Case1. The Error and Exception happened at the same time -- only count Exception, exclude Error
// Error this was test error... java....ClassCastException
Case2. The Error happened only -- only count Error
// Error this message from hr_test
Case3. The Exception happened only -- only count Exception
This will accomplish what you're looking for. This will give a distinct count of exceptions with Error and Exception OR just Exception.. I also think your rex command is wrong as there's no Splunk name defined in the capture group..
index=index1 (Error AND Exception) OR "Exception" | rex ".?(?(?:\w+.)+\w?Exception).*" | stats dc(Exception) by index,sourcetype , exception