Splunk Search

how to search a list with *Exceptions

vincenty
Explorer

I want to search from a list of the following *Exceptions from log files. I don't have a field defined nor know how to define it. I want get a table report with number of occurrences for each type of exceptions. I think I may be able to do it with inputlookup but not sure how to get started.... please help

com.sun.jersey.api.client.ClientHandlerException

org.eclipse.persistence.exceptions.OptimisticLockException

Locks.checkThreadStopException

com.sun.xml.ws.client.ClientTransportException

java.io.IOException

java.lang.Exception

java.lang.IllegalAccessException

java.lang.reflect.InvocationTargetException
java.lang.RuntimeException
java.net.ConnectException,
java.net.SocketException
java.rmi.NoSuchObjectException

java.util.MissingResourceException

javax.ejb.NoSuchEJBException

javax.faces.application.ViewExpiredException
javax.faces.FacesException

javax.mail.MessagingException
...

Tags (1)
0 Karma

jonuwz
Influencer

Try this for a starter

Exception | rex ".*?(?<exception>(?:\w+\.)+\w*?Exception).*"
          | stats count by exception

acveer
Engager

Thank you. this worked for me.

0 Karma

vincenty
Explorer

ok thx. Can use the patterns as you've provided to search with the following. Is there a easier way to do this especially if I add another level?

Exception | rex "(?:^|\s)(?\w+.\w+.\w+.\w+Exception)(?:\s|$)" | search Exception | rex "(?:^|\s)(?\w+.\w+.\w+Exception)(?:\s|$)" |stats count by exception

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

A Four-Part Event Series: Full Stack Observability For the AI Era

As AI reshapes applications, infrastructure, and the way teams operate, the traditional boundaries of ...

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

AI has fundamentally raised the stakes for security operations, and this three-part series is your guide to ...