How to get the distinct count of the number of "Errors" or "Exceptions"?

[jw44250]

I have used this following Splunk search, but the output result is not correct. I am using OR operator for either Error or Exception, but i need only Exception but not Error. But sometimes Error and Exception can appear at the same. And sometimes only Error appears.

(index=index1) ("Error") OR (*Exception*)  | rex ".*?(?(?:\w+\.)+\w*?Exception).*" | stats count by  index,sourcetype , exception

The following cases:

Case1. The Error and Exception happened at the same time -- only count Exception, exclude Error

// Result 
// Error this was test error... java....ClassCastException

Case2. The Error happened only -- only count Error

// Result 
// Error this message from hr_test 

Case3. The Exception happened only -- only count Exception
// result

// java.io.FileNotFoundException

Thanks in advance your assistance

[skoelpin]

This will accomplish what you're looking for. This will give a distinct count of exceptions with Error and Exception OR just Exception.. I also think your rex command is wrong as there's no Splunk name defined in the capture group..

index=index1 (Error AND Exception) OR "Exception" | rex ".?(?(?:\w+.)+\w?Exception).*" | stats dc(Exception) by index,sourcetype , exception

[jw44250]

still the total count for exception is not correct -- i want to use IN operator something like this

index=index* . EXception IN(NPE, SQLNotFOund, FILE) |stats count by exception...

The query does but its counts all the exception which is the same log...i am not interest the word exception at all