Want a Dashboard to display all exceptions occured in the last 30 days in a graphical way.

[Harish429]

Hi Team,

I want to have a query which displays me all types of exceptions occured in the last 30 days in a table way or else in a graphical way.

We just wanted to see the count of the exceptions every 30 days.

I have been using this query but it didnt work.

Iam new to splunk so please help me to find out

index=dev | rex field=_raw "\b(?(java|javax).[\w.]+Exception)" | chart count by exception_type

[ITWhisperer]

You need to actually extract the values into a field - you might also consider escaping the dots as an unescaped dot in regex means any character.

| rex field=_raw "\b(?<exception_type>(java|javax)\.[\w\.]+Exception)"

[Harish429]

Can you pleas suggest me query which gives me all types of exceptions

[ITWhisperer]

Of course I can try, if you can give me a list of all the exception types you want to capture.

[Harish429]

I want all expections which are getting entered.like in the splunk log if we have exception encountered it shoud fetch that

[ITWhisperer]

So, search for "exception". This will return events which have this word in. However, this might give you some false positives, so you need to be more precise about defining exactly what you consider to be an exception event. Once you have these, you can look to extract the exception type for your statistics.

[rrovers]

Do you mean this:

index=dev | rex field=_raw "\b(?(java|javax).[\w.]+Exception)"
| timechart span=30d count by exception_type

for graphics choose "Visualisations"

[Harish429]

I was getting this error while searching

Error in 'rex' command: Encountered the following error while compiling the regex '\b(?(java|javax).[\w.]+Exception)': Regex: syntax error in subpattern name (missing terminator).