https://community.splunk.com/t5/Splunk-Search/How-to-find-the-top-10-error-codes-by-each-host-and-display-the/m-p/213097#M62486 <P>Thanks for your response, but with the above query its showing only 10 servers, with the event code &amp; count.</P> <P>i need the list of all server with the 10 errors as the column in it.</P> <P>Host A EventCode EventCode EventCode EventCode EventCode EventCode EventCode EventCode EventCode EventCode<BR /> Host B EventCode EventCode EventCode EventCode EventCode EventCode EventCode EventCode EventCode EventCode<BR /> Host C EventCode EventCode EventCode EventCode EventCode EventCode EventCode EventCode EventCode EventCode<BR /> Host D EventCode EventCode EventCode EventCode EventCode EventCode EventCode EventCode EventCode EventCode<BR /> Host E EventCode EventCode EventCode EventCode EventCode EventCode EventCode EventCode EventCode EventCode<BR /> Host F EventCode EventCode EventCode EventCode EventCode EventCode EventCode EventCode EventCode EventCode<BR /> Host G EventCode EventCode EventCode EventCode EventCode EventCode EventCode EventCode EventCode EventCode</P> Thu, 10 Nov 2016 09:21:30 GMT SathyaNarayanan 2016-11-10T09:21:30Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-top-10-error-codes-by-each-host-and-display-the/m-p/213090#M62479 <P>Hi,</P> <P>I have list of servers, I need to find top Event Codes errors for each host, as each host as different Event codes. How to list them in a single table and show the number of Event codes count?</P> <P>Eg; The table should be like below</P> <PRE><CODE>Host acdc 5678 1842 7415 adfdf 3485 7684 1582 </CODE></PRE> Mon, 07 Nov 2016 10:40:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-top-10-error-codes-by-each-host-and-display-the/m-p/213090#M62479 SathyaNarayanan 2016-11-07T10:40:07Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-top-10-error-codes-by-each-host-and-display-the/m-p/213091#M62480 <P>See if the following works for you:</P> <PRE><CODE>your base search here | stats count by EventCode, host | sort limit=0 host, - count | streamstats count as top by host | where top &lt;= 10 | stats list(EventCode) as EventCode, list(count) as count by host </CODE></PRE> <P>Thanks,<BR /> J</P> Mon, 07 Nov 2016 11:08:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-top-10-error-codes-by-each-host-and-display-the/m-p/213091#M62480 javiergn 2016-11-07T11:08:26Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-top-10-error-codes-by-each-host-and-display-the/m-p/213092#M62481 <P>I have edited my answer as per you last example to display top 10 host names and EventCode. Try the following:</P> <P>your base search | <STRONG>eval myField= host + " - " + EventCode| top 10 myField showperc=f</STRONG></P> <P>-----Editing answer again--- Following will give top 10 EventCode counts over all hosts:. Please try and confirm(eventstats will add ECCount field to all existing event which can be used in stats sum command later):</P> <P>your base search here <STRONG>| eventstats count as ECCount by EventCode | chart limit=10 userother=f sum(ECCount) over host by EventCode</STRONG></P> Mon, 07 Nov 2016 14:43:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-top-10-error-codes-by-each-host-and-display-the/m-p/213092#M62481 niketn 2016-11-07T14:43:30Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-top-10-error-codes-by-each-host-and-display-the/m-p/213093#M62482 <P>When i execute the above command, am getting the results as below</P> <P>host 3688 10016 7001 5722 ......................................<BR /> asdfd 0 0 1 0<BR /> kjhl 0 1 0 0<BR /> mk; 1 0 0 0</P> <P>It goes on like this</P> Wed, 09 Nov 2016 10:00:38 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-top-10-error-codes-by-each-host-and-display-the/m-p/213093#M62482 SathyaNarayanan 2016-11-09T10:00:38Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-top-10-error-codes-by-each-host-and-display-the/m-p/213094#M62483 <P>Sorry but your example doesn't really help as I don't know what the numbers mean. Are they counts? are they event codes?</P> <P>Something like this would help:</P> <PRE><CODE>HOSTA EventCode1 Count1 HOSTA EventCode2 Count2 .... </CODE></PRE> Wed, 09 Nov 2016 10:23:13 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-top-10-error-codes-by-each-host-and-display-the/m-p/213094#M62483 javiergn 2016-11-09T10:23:13Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-top-10-error-codes-by-each-host-and-display-the/m-p/213095#M62484 <P>Need to show top errors for each host with event code count</P> Wed, 09 Nov 2016 10:35:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-top-10-error-codes-by-each-host-and-display-the/m-p/213095#M62484 SathyaNarayanan 2016-11-09T10:35:03Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-top-10-error-codes-by-each-host-and-display-the/m-p/213096#M62485 <P>Above query should return result in the following format:</P> <P>HOSTA - EventCode1 Count1<BR /> HOSTA - EventCode2 Count2<BR /> ....</P> Wed, 09 Nov 2016 12:29:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-top-10-error-codes-by-each-host-and-display-the/m-p/213096#M62485 niketn 2016-11-09T12:29:09Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-top-10-error-codes-by-each-host-and-display-the/m-p/213097#M62486 <P>Thanks for your response, but with the above query its showing only 10 servers, with the event code &amp; count.</P> <P>i need the list of all server with the 10 errors as the column in it.</P> <P>Host A EventCode EventCode EventCode EventCode EventCode EventCode EventCode EventCode EventCode EventCode<BR /> Host B EventCode EventCode EventCode EventCode EventCode EventCode EventCode EventCode EventCode EventCode<BR /> Host C EventCode EventCode EventCode EventCode EventCode EventCode EventCode EventCode EventCode EventCode<BR /> Host D EventCode EventCode EventCode EventCode EventCode EventCode EventCode EventCode EventCode EventCode<BR /> Host E EventCode EventCode EventCode EventCode EventCode EventCode EventCode EventCode EventCode EventCode<BR /> Host F EventCode EventCode EventCode EventCode EventCode EventCode EventCode EventCode EventCode EventCode<BR /> Host G EventCode EventCode EventCode EventCode EventCode EventCode EventCode EventCode EventCode EventCode</P> Thu, 10 Nov 2016 09:21:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-top-10-error-codes-by-each-host-and-display-the/m-p/213097#M62486 SathyaNarayanan 2016-11-10T09:21:30Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-top-10-error-codes-by-each-host-and-display-the/m-p/213098#M62487 <P>I have added a second search query as per your example above. Can you check and confirm whether it works for you or not?</P> Thu, 10 Nov 2016 10:23:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-top-10-error-codes-by-each-host-and-display-the/m-p/213098#M62487 niketn 2016-11-10T10:23:16Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-top-10-error-codes-by-each-host-and-display-the/m-p/213099#M62488 <P>i tried with your new query, that is also not helping it. </P> <P>Thanks for your time</P> Thu, 10 Nov 2016 10:53:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-top-10-error-codes-by-each-host-and-display-the/m-p/213099#M62488 SathyaNarayanan 2016-11-10T10:53:37Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-top-10-error-codes-by-each-host-and-display-the/m-p/213100#M62489 <P>Do you mean the output is not what you expect or does the query has any issue? Can you share the output?</P> Thu, 10 Nov 2016 11:08:55 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-top-10-error-codes-by-each-host-and-display-the/m-p/213100#M62489 niketn 2016-11-10T11:08:55Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-top-10-error-codes-by-each-host-and-display-the/m-p/213101#M62490 <P>Based on your answers below I'm guessing this is what you are looking for:</P> <PRE><CODE>your base search here | stats count by EventCode, host | sort limit=0 host, - count | streamstats count as top by host | where top &lt;= 10 | stats list(EventCode) as EventCode by host | eval EventCode = mvjoin(EventCode, " ") </CODE></PRE> <P>This would give you a similar output to the one you listed below:</P> <P>Host A EventCode EventCode EventCode EventCode EventCode EventCode EventCode EventCode EventCode EventCode<BR /> Host B EventCode EventCode EventCode EventCode EventCode EventCode EventCode EventCode EventCode EventCode<BR /> Host C EventCode EventCode EventCode EventCode EventCode EventCode EventCode EventCode EventCode EventCode<BR /> Host D EventCode EventCode EventCode EventCode EventCode EventCode EventCode EventCode EventCode EventCode<BR /> Host E EventCode EventCode EventCode EventCode EventCode EventCode EventCode EventCode EventCode EventCode<BR /> Host F EventCode EventCode EventCode EventCode EventCode EventCode EventCode EventCode EventCode EventCode<BR /> Host G EventCode EventCode EventCode EventCode EventCode EventCode EventCode EventCode EventCode EventCode</P> Thu, 10 Nov 2016 14:56:43 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-top-10-error-codes-by-each-host-and-display-the/m-p/213101#M62490 javiergn 2016-11-10T14:56:43Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-top-10-error-codes-by-each-host-and-display-the/m-p/213102#M62491 <P>Why not :</P> <PRE><CODE>... base_search ... | top EventCode by host </CODE></PRE> <P>Quite simple ... or I missed something ... ?</P> Thu, 10 Nov 2016 15:50:48 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-top-10-error-codes-by-each-host-and-display-the/m-p/213102#M62491 Rocket66 2016-11-10T15:50:48Z