topic Re: Table ordered by OID occurrence count in Splunk Search

Table ordered by OID occurrence count

splunk_zen — Tue, 11 Feb 2014 18:02:13 GMT

Hi,
what would be the SPL to return a table ordered by most common oid, server ?

2014-02-11 17:09:23,855 ERROR SNMP get returned empty value: SWITCH-UAT-07 1.3.6.1.4.1.9.9.117.1.1.2.1.3.104000023

2014-02-11 16:06:01,655 ERROR SNMP get returned empty value: server-prd-01 1.3.6.1.4.1.232.6.2.6.8.1.6.1.9

2014-02-11 14:48:26,846 ERROR SNMP get returned empty value: SWITCH-US1 1.3.6.1.2.1.31.1.1.1.11.5

Re: Table ordered by OID occurrence count

lukejadamec — Tue, 11 Feb 2014 18:50:09 GMT

Which value is the oid?

Is the oid already extracted as a field?

Re: Table ordered by OID occurrence count

somesoni2 — Tue, 11 Feb 2014 19:34:30 GMT

Try this:

sourcetype=yoursourcetype | rex "(?i) value: (?P<server>[^ ]+) (?P<oid>.*)" | table _time, server, oid | stats count by server,oid | sort -count

Re: Table ordered by OID occurrence count

splunk_zen — Wed, 12 Feb 2014 08:43:13 GMT

Simple and effective,
thanks !