https://community.splunk.com/t5/Splunk-Search/Top-errors-with-hosts/m-p/32667#M6855 <P>I have a search that sends me the top 10 errors on all of our servers each morning:</P> <P>error OR Error OR alert OR Alert OR fail* OR Fail* source="WMI:WinEventLog*" | top limit=10 Message</P> <P>But this would be much more helpful if I could, for each error, see which server(s) it has occurred on.</P> <P>I assume I need to run a subsearch to figure out which server(s) the error has ocurred?</P> Wed, 22 Jun 2011 14:44:17 GMT jamesklassen 2011-06-22T14:44:17Z https://community.splunk.com/t5/Splunk-Search/Top-errors-with-hosts/m-p/32667#M6855 <P>I have a search that sends me the top 10 errors on all of our servers each morning:</P> <P>error OR Error OR alert OR Alert OR fail* OR Fail* source="WMI:WinEventLog*" | top limit=10 Message</P> <P>But this would be much more helpful if I could, for each error, see which server(s) it has occurred on.</P> <P>I assume I need to run a subsearch to figure out which server(s) the error has ocurred?</P> Wed, 22 Jun 2011 14:44:17 GMT https://community.splunk.com/t5/Splunk-Search/Top-errors-with-hosts/m-p/32667#M6855 jamesklassen 2011-06-22T14:44:17Z https://community.splunk.com/t5/Splunk-Search/Top-errors-with-hosts/m-p/32668#M6856 <P>Using a subsearch is overkill -- use <CODE>stats</CODE> instead. Something like the following should work.</P> <PRE><CODE>error OR alert OR fail source="WMI:WinEventLog*" | stats count values(host) by Message | sort - count | head 10 </CODE></PRE> Wed, 22 Jun 2011 14:52:57 GMT https://community.splunk.com/t5/Splunk-Search/Top-errors-with-hosts/m-p/32668#M6856 southeringtonp 2011-06-22T14:52:57Z https://community.splunk.com/t5/Splunk-Search/Top-errors-with-hosts/m-p/32669#M6857 <P>Perfect, thank you</P> Wed, 22 Jun 2011 16:03:09 GMT https://community.splunk.com/t5/Splunk-Search/Top-errors-with-hosts/m-p/32669#M6857 jamesklassen 2011-06-22T16:03:09Z https://community.splunk.com/t5/Splunk-Search/Top-errors-with-hosts/m-p/32670#M6858 <P>Unless I'm mistaken, the strings you're searching for are case-insensitive. In fact, I had asked this a while back, but I don't think you can have Splunk do a case-sensitive search. So in your case, you really only need</P> <P>error OR alert OR fail ...</P> Thu, 23 Jun 2011 19:28:55 GMT https://community.splunk.com/t5/Splunk-Search/Top-errors-with-hosts/m-p/32670#M6858 mfrost8 2011-06-23T19:28:55Z