limiting error per event

[cloud111]

Hi,

I am new to splunk and would like guidance about how to only count 1 occurrence of the word ERROR per event.

example line:
2014-05-14 20:17:46,232 ERROR ejb.services.RestClientService Error processing response

my search is counting both errors in the line and i only need the first one

the search is:
index=main sourcetype=* source=* host=* ERROR source="D:/server.log"

[somesoni2]

WHat is your full search? How are you/search is counting it twice?

Are you just trying to select events with ERROR after timestamp? If yes try this

index=main sourcetype= source= host=* ERROR source="D:/server.log" | regex _raw="^\S+\s+\S+\s+ERROR\s.+"

If you're looking for just upper case ERROR, try this

index=main sourcetype= source= host=* CASE(ERROR) source="D:/server.log"

[cloud111]

Brilliant it works for me, I needed the first ERROR after the timestamp.
thanks so much for your help.