SPLUNK - mosinn/DOCS-n-Snippets-n-Steps GitHub Wiki
TVT and Finding Errors
index=?????? ( ("Exception") OR (" ERROR ") OR ("Caused ") OR ("at com") ) AND ( NOT ("exception=null") )
TVT Caps [space]ERROR[space]
index=xxx AND CASE("ERROR") NOT ("something excluded") | regex "(?m)[\r\n\s]ERROR[\r\n\s]"