topic Re: Find top 20 client IPs that generate the most errors and display individual error status counts for each client IP in Splunk Search

Find top 20 client IPs that generate the most errors and display individual error status counts for each client IP

Kaitrono — Tue, 23 Jun 2015 17:46:32 GMT

I have only been using Splunk for a few days and couldn't find an answer to this question.
I want to find the client IPs that are generating the most errors and display the count of each specific error as well. However, I want my search to be limited to 20 client IPs (the 20 that generate the most errors).
I'm able to get a list of all client IPs right now

index=blah tag=blah AND (status=302 OR status=304 OR status=403 OR status=404 OR status=500) 
| stats count(status) as "Total Errors" count(eval(status=302)) as "302 Count" count(eval(status=304)) as "304 Count" count(eval(status=403)) as "403 Count" count(eval(status=404)) as "404 Count" count(eval(status=500)) as "500 Count" by clientip 
| sort -"Total Errors"

This creates a table like so:

clientip   | Total Errors | 302 Count | 304 Count | 403 Count | 404 Count | 500 Count 
142.182.28 |      20      |    13     |     5     |     1     |     1     |     0

I'm not showing all the results obviously, but the table lists data for every clientip and every time I try to limit the results, the search is messed up. I would appreciate any help with what I am doing wrong.

Re: Find top 20 client IPs that generate the most errors and display individual error status counts for each client IP

richgalloway — Tue, 23 Jun 2015 18:04:15 GMT

How about ... | sort - "Total Errors" | top limit=20 "Total Errors" ?

Re: Find top 20 client IPs that generate the most errors and display individual error status counts for each client IP

acharlieh — Tue, 23 Jun 2015 18:04:46 GMT

You're very close! The thing you're missing is that the sort command can take a number to give the top N.

So all you have to do is change your line:

| sort - "Total Errors"

to:

| sort 20 - "Total Errors"

Re: Find top 20 client IPs that generate the most errors and display individual error status counts for each client IP

acharlieh — Tue, 23 Jun 2015 18:07:53 GMT

Except that using top would eliminate the all of the other fields, "clientip", and the "### Count"

Re: Find top 20 client IPs that generate the most errors and display individual error status counts for each client IP

Kaitrono — Tue, 23 Jun 2015 18:20:21 GMT

Thank you! I was not aware sort could take that parameter and this worked.