Search code examples
splunksplunk-query

Splunk Query - Search unique exception from logs with counts

I want to search exceptions along with its occurrences. I would like see results in below format

|Exception Name      |Count|
|NullPointerException|  2  |
|ConnectException    |  6  |
|MailConnectException|  10 |

Logs looks like this -

- Caused by: java.lang.NullPointerException: null
- Caused by: com.sun.mail.util.MailConnectException: Couldn't connect to host, port: localhost, 25; timeout -1
- Caused by: java.net.ConnectException: Connection refused (Connection refused)

Written below search query -

index="*zp0853-a*" container_name="test-api" "*Caused by*" (Showing all Exceptions list)
index="*zp0853-a*" container_name="test-api" "*Caused by*" | stats count (Showing only total counts)
Solution

  • To get counts for each exception you'll need to extract the exception name. I like to use rex for that.

    index="*zp0853-a*" container_name="test-api" "*Caused by*" 
| rex "by: (?<exception>[^:]+)"
| stats count by exception