CODEWITHSUNDEEP
splunksplunk-query
Morez
Morez

Reputation: 2186

Splunk Query - Search unique exception from logs with counts

I want to search exceptions along with its occurrences. I would like see results in below format

|Exception Name      |Count|
|NullPointerException|  2  |
|ConnectException    |  6  |
|MailConnectException|  10 |

Logs looks like this -

- Caused by: java.lang.NullPointerException: null
- Caused by: com.sun.mail.util.MailConnectException: Couldn't connect to host, port: localhost, 25; timeout -1
- Caused by: java.net.ConnectException: Connection refused (Connection refused)

Written below search query -

index="*zp0853-a*" container_name="test-api" "*Caused by*" (Showing all Exceptions list)
index="*zp0853-a*" container_name="test-api" "*Caused by*" | stats count (Showing only total counts)

Upvotes: 0

Views: 3755

Answers (2)

RichG
RichG

Reputation: 9906

To get counts for each exception you'll need to extract the exception name. I like to use rex for that.

index="*zp0853-a*" container_name="test-api" "*Caused by*" 
| rex "by: (?<exception>[^:]+)"
| stats count by exception

Upvotes: 4

Raven
Raven

Reputation: 198

You should split the "_raw" with correct separator and mouve into the splitted with mvindex

eval exception=mvindex(split(_raw,":"),1)|stats count by exception

Upvotes: 1

Related Questions