Splunk Search
Highlighted

How to get the distinct count of the number of "Errors" or "Exceptions"?

New Member

I have used this following Splunk search, but the output result is not correct. I am using OR operator for either Error or Exception, but i need only Exception but not Error. But sometimes Error and Exception can appear at the same. And sometimes only Error appears.

(index=index1) ("Error") OR (*Exception*)  | rex ".*?(?(?:\w+\.)+\w*?Exception).*" | stats count by  index,sourcetype , exception

The following cases:

Case1. The Error and Exception happened at the same time -- only count Exception, exclude Error

// Result 
// Error this was test error... java....ClassCastException

Case2. The Error happened only -- only count Error

// Result 
// Error this message from hr_test 

Case3. The Exception happened only -- only count Exception
// result

// java.io.FileNotFoundException

Thanks in advance your assistance

Tags (2)
0 Karma
Highlighted

Re: How to get the distinct count of the number of "Errors" or "Exceptions"?

SplunkTrust
SplunkTrust

This will accomplish what you're looking for. This will give a distinct count of exceptions with Error and Exception OR just Exception.. I also think your rex command is wrong as there's no Splunk name defined in the capture group..

index=index1 (Error AND Exception) OR "Exception" | rex ".?(?(?:\w+.)+\w?Exception).*" | stats dc(Exception) by index,sourcetype , exception

0 Karma
Highlighted

Re: How to get the distinct count of the number of "Errors" or "Exceptions"?

New Member

still the total count for exception is not correct -- i want to use IN operator something like this

index=index* . EXception IN(NPE, SQLNotFOund, FILE) |stats count by exception...

The query does but its counts all the exception which is the same log...i am not interest the word exception at all

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.