most common events

tlow — Mon, 28 Sep 2020 16:41:16 GMT

Hello, in my search how do i find most common events.

tried this | cluster | table cluster_count, _raw | sort - cluster_count
but not displaying the cluster_count.

need to find what errors are generated the most.
Thanks

Re: most common events

lguinn2 — Wed, 21 May 2014 19:31:49 GMT

The problem as I see it: you need to decide how to group the events. You can try cluster but it better if you define "common".

Here is one possible search:

error* | stats count by source sourcetype host | sort -count

This will give you a count of the events that contain the word "error", with the most common host source and sourcetype listed first in the list.

Here is another - this also groups the errors by including a few of the characters that surround the word "error"

error* | rex "(?<msg>.{0,25}error.{0,25})"  | stats count by source sourcetype host msg | sort -count