SPLUNK - mosinn/DOCS-n-Snippets-n-Steps GitHub Wiki

TVT and Finding Errors

index=?????? ( ("Exception") OR (" ERROR ") OR ("Caused ") OR ("at com") ) AND ( NOT ("exception=null") )

TVT Caps [space]ERROR[space]

index=xxx AND CASE("ERROR") NOT ("something excluded") | regex "(?m)[\r\n\s]ERROR[\r\n\s]"