I am trying to create a table (and then a report) of all exceptions/errors that occur for a given sourcetype.
The primary problem (i suspect) is that I am not doing a count on a given field. The reason for this is that there is nothing common to extract that I can see so far because there are no key-value pairs when it comes to errors/exceptions.
My query looks like:
I didn't think counting on "events" was going to work, but I had to start somewhere.
Some of the data returned would by just the first portion of the query would be:
Any ideas what I can do here to count just the events? It would be nice to know how many NullPointerExceptions, Errors, or FileNotFoundExceptions there are per sourcetype, but I don't think I'm to that point yet.
asked 18 Nov '10, 22:54
So is the goal to get a table containing each sourcetype and the number of error events?
If you need more granularity, remember that eventtypes can be nested, so one approach would be to simply create a set of new eventtypes, then chart by
In eventtypes.conf (or configure via the manager):
Once you have the eventtypes defined, use
answered 18 Nov '10, 23:22