Splunk查询-从具有计数的日志中搜索唯一异常

Question

我想搜索异常及其出现情况。我想以以下格式查看结果

npm install -g @angular/cli

日志如下所示-

|Exception Name      |Count|
|NullPointerException|  2  |
|ConnectException    |  6  |
|MailConnectException|  10 |

写在搜索查询下方-

- Caused by: java.lang.NullPointerException: null
- Caused by: com.sun.mail.util.MailConnectException: Couldn't connect to host, port: localhost, 25; timeout -1
- Caused by: java.net.ConnectException: Connection refused (Connection refused)

Answer 1

您应使用正确的分隔符将“ _raw”分割，然后将其插入mvindex分割的

eval exception=mvindex(split(_raw,":"),1)|stats count by exception

Answer 2

要获取每个异常的计数，您需要提取异常名称。我喜欢为此使用rex。

index="*zp0853-a*" container_name="test-api" "*Caused by*" 
| rex "by: (?<exception>[^:]+)"
| stats count by exception