Splunk Search

How to view my error name in where clause?

karthi2809
Builder

Now i am getting only count i need error messages and host

index=test "java.nio.channels.ClosedChannelException" |stats count |where count > 10

Tags (2)
0 Karma
1 Solution

mayurr98
Super Champion

You can do that if you have a field in which error_message is already extracted. If it is not, then you have to manually extract it and then build a search query. If you can give me a sample event and tell what is the error message that you want to show then I can build a search query for you.

If the error message is specific i.e. java.nio.channels.ClosedChannelException

index=test "java.nio.channels.ClosedChannelException" 
| stats count by host 
| where count>10 
| eval error_message="java.nio.channels.ClosedChannelException"

let me know if this helps!

View solution in original post

mayurr98
Super Champion

You can do that if you have a field in which error_message is already extracted. If it is not, then you have to manually extract it and then build a search query. If you can give me a sample event and tell what is the error message that you want to show then I can build a search query for you.

If the error message is specific i.e. java.nio.channels.ClosedChannelException

index=test "java.nio.channels.ClosedChannelException" 
| stats count by host 
| where count>10 
| eval error_message="java.nio.channels.ClosedChannelException"

let me know if this helps!

493669
Super Champion

Try this:

index=test "java.nio.channels.ClosedChannelException" |stats count by error_messages, host|where count > 10
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...