Splunk Query - Search unique exception from logs with counts

0
votes

I want to search exceptions along with its occurrences. I would like see results in below format

|Exception Name      |Count|
|NullPointerException|  2  |
|ConnectException    |  6  |
|MailConnectException|  10 |

Logs looks like this -

- Caused by: java.lang.NullPointerException: null
- Caused by: com.sun.mail.util.MailConnectException: Couldn't connect to host, port: localhost, 25; timeout -1
- Caused by: java.net.ConnectException: Connection refused (Connection refused)

Written below search query -

index="*zp0853-a*" container_name="test-api" "*Caused by*" (Showing all Exceptions list)
index="*zp0853-a*" container_name="test-api" "*Caused by*" | stats count (Showing only total counts)
2
splunksplunk-query

2 Answers

2
votes

To get counts for each exception you'll need to extract the exception name. I like to use rex for that.

index="*zp0853-a*" container_name="test-api" "*Caused by*" 
| rex "by: (?<exception>[^:]+)"
| stats count by exception
1
votes

You should split the "_raw" with correct separator and mouve into the splitted with mvindex

eval exception=mvindex(split(_raw,":"),1)|stats count by exception