https://community.splunk.com/t5/Security/print-the-error-code-count/m-p/327619#M12897 <P>|stats count by mbReturnCode,mbBrokerName,mbExecutingGroupName<BR /> ↓<BR /> |top limit=20 mbReturnCode,mbBrokerName,mbExecutingGroupName</P> Mon, 11 Sep 2017 09:39:02 GMT HiroshiSatoh 2017-09-11T09:39:02Z https://community.splunk.com/t5/Security/print-the-error-code-count/m-p/327616#M12894 <P>I want to create the dashboard to show error count for specific execution group on specific broker, Below is the query,</P> <P>index=BEM source="/apps/wmb/brokerlogs/mqsi.log" mbReturnCode="*" |table mbReturnCode mbBrokerName mbExecutingGroupName <BR /> I have getting below result,<BR /> mbReturnCode mbBrokerName mbExecutingGroupName<BR /> 1 BIP2604 BK_MQLP37LB BEM_CARD_SERVICES<BR /> 2 BIP2623 BK_MQLP37LB BEM_CARD_SERVICES<BR /> 3 BIP2604 BK_MQLP37LB BEM_CARD_SERVICES<BR /> 4 BIP2623 BK_MQLP37LB BEM_CARD_SERVICES</P> <P>But require below one<BR /> mbReturnCode mbBrokerName mbExecutingGroupName Count(*)<BR /> 1 BIP2604 BK_MQLP37LB BEM_CARD_SERVICES 115<BR /> 2 BIP2623 BK_MQLP01LB Payment 96<BR /> 3 BIP2545 BK_MQLP02LB Merchant_mgt 44</P> <P>Could you please help me.</P> <P>Splunk version- 6.5.0</P> Tue, 29 Sep 2020 15:41:31 GMT https://community.splunk.com/t5/Security/print-the-error-code-count/m-p/327616#M12894 ajaynaralikar 2020-09-29T15:41:31Z https://community.splunk.com/t5/Security/print-the-error-code-count/m-p/327617#M12895 <P>Try this!</P> <PRE><CODE>index=BEM source="/apps/wmb/brokerlogs/mqsi.log" mbReturnCode="*" |stats count by mbReturnCode,mbBrokerName,mbExecutingGroupName </CODE></PRE> Mon, 11 Sep 2017 08:34:30 GMT https://community.splunk.com/t5/Security/print-the-error-code-count/m-p/327617#M12895 HiroshiSatoh 2017-09-11T08:34:30Z https://community.splunk.com/t5/Security/print-the-error-code-count/m-p/327618#M12896 <P>Thanks HiroshiSatoh.<BR /> Could you please do one more help. <BR /> I want to print top 20 count value in sorted order</P> Mon, 11 Sep 2017 09:03:02 GMT https://community.splunk.com/t5/Security/print-the-error-code-count/m-p/327618#M12896 ajaynaralikar 2017-09-11T09:03:02Z https://community.splunk.com/t5/Security/print-the-error-code-count/m-p/327619#M12897 <P>|stats count by mbReturnCode,mbBrokerName,mbExecutingGroupName<BR /> ↓<BR /> |top limit=20 mbReturnCode,mbBrokerName,mbExecutingGroupName</P> Mon, 11 Sep 2017 09:39:02 GMT https://community.splunk.com/t5/Security/print-the-error-code-count/m-p/327619#M12897 HiroshiSatoh 2017-09-11T09:39:02Z https://community.splunk.com/t5/Security/print-the-error-code-count/m-p/327620#M12898 <P>Hey @ajaynaralikar, Please be sure that when responding to someone's answer, click on "Add comment" directly below their answer or, if responding to someone's comment, type in the "Add your comment..." box directly below their comment. You typed your last response in the "Enter your answer here..." box at the very bottom of the page which, instead, posted a brand new answer. This will help with a clean continuous flow of the conversation. I already converted your "answer" to comments, so just something to keep in mind from here on out. Thanks and happy Splunking!</P> Mon, 11 Sep 2017 21:43:17 GMT https://community.splunk.com/t5/Security/print-the-error-code-count/m-p/327620#M12898 lfedak_splunk 2017-09-11T21:43:17Z https://community.splunk.com/t5/Security/print-the-error-code-count/m-p/327621#M12899 <P>Sure.<BR /> Next time will follow this.</P> Tue, 12 Sep 2017 05:54:37 GMT https://community.splunk.com/t5/Security/print-the-error-code-count/m-p/327621#M12899 ajaynaralikar 2017-09-12T05:54:37Z