I have used this following Splunk search, but the output result is not correct. I am using OR operator for either Error or Exception, but i need only Exception but not Error. But sometimes Error and Exception can appear at the same. And sometimes only Error appears.
(index=index1) ("Error") OR (*Exception*) | rex ".*?(?(?:\w+\.)+\w*?Exception).*" | stats count by index,sourcetype , exception
The following cases:
Case1. The Error and Exception happened at the same time -- only count Exception, exclude Error
// Result
// Error this was test error... java....ClassCastException
Case2. The Error happened only -- only count Error
// Result
// Error this message from hr_test
Case3. The Exception happened only -- only count Exception
// result
// java.io.FileNotFoundException
Thanks in advance your assistance
... View more