Splunk Search

Question on how to use the lookup file for Exception monitoring

Deepz2612
Explorer

I have a lookup file which has below coloumns.

Exception_Name Exception_Keyword Comments
REXC RemoteException Alerted
JNEXC Exception-NullPointer Ignorable

Now in the logs when the Exception_Keyword occurs,It should look for the lookupfile and take the Exception_Name,Comments and give the result with host and count also.
And if the Exception_Keyword does not exists in lookup it should be listed as New..and when clicking on New it should show me all the new exceptions(_raw events)

Expected output as below :

Exception_Name Exception_Keyword Host count
REXC RemoteException XYZ 67
New soapexception ABC 3

Further drilling down to the New exception It should show me this list of it..Same with others also.

0 Karma

Deepz2612
Explorer

Can someone help me with this please

0 Karma
Get Updates on the Splunk Community!

AI for AppInspect

We’re excited to announce two new updates to AppInspect designed to save you time and make the app approval ...

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...