Splunk Search

Want a Dashboard to display all exceptions occured in the last 30 days in a graphical way.

Harish429
Loves-to-Learn Lots

Hi Team,

I want to have a query which displays me all types of exceptions occured in the last 30 days in a table way or else in a graphical way.

We just wanted to see the count of the exceptions every 30 days.

I have been using this query but it didnt work.

Iam new to splunk so please help me to find out

index=dev | rex field=_raw "\b(?(java|javax).[\w.]+Exception)" | chart count by exception_type

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You need to actually extract the values into a field - you might also consider escaping the dots as an unescaped dot in regex means any character.

| rex field=_raw "\b(?<exception_type>(java|javax)\.[\w\.]+Exception)"
0 Karma

Harish429
Loves-to-Learn Lots

Can you pleas suggest me query which gives me all types of exceptions

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Of course I can try, if you can give me a list of all the exception types you want to capture.

0 Karma

Harish429
Loves-to-Learn Lots

I want all expections which are getting entered.like in the splunk log if we have exception encountered it shoud fetch that

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

So, search for "exception". This will return events which have this word in. However, this might give you some false positives, so you need to be more precise about defining exactly what you consider to be an exception event. Once you have these, you can look to extract the exception type for your statistics.

0 Karma

rrovers
Communicator

Do you mean this:

 

 

index=dev | rex field=_raw "\b(?(java|javax).[\w.]+Exception)"
| timechart span=30d count by exception_type

 

for graphics choose "Visualisations"

 

0 Karma

Harish429
Loves-to-Learn Lots

I was getting this error while searching

Error in 'rex' command: Encountered the following error while compiling the regex '\b(?(java|javax).[\w.]+Exception)': Regex: syntax error in subpattern name (missing terminator).

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...