Security

Devices with the most error

Starky
Explorer

Hello,
I am new to splunk and would like some help in displaying the top devices on my network that produces the most error. Can someone assist??

Tags (4)
0 Karma

dshpritz
SplunkTrust
SplunkTrust

Your best bet would be to find your error events, and then create eventtypes for them. You would then be able to search for the eventtype, and get a count of the hosts. For example:

index=firewall eventtype=fw_input_errors | stats count by host

For the time period you can use the time picker, or add it to the search:

earliest=-7d latest=now index=firewall eventtype=fw_input_errors | stats count by host

More on eventtypes:

http://docs.splunk.com/Documentation/Splunk/latest/knowledge/Defineeventtypes

http://docs.splunk.com/Documentation/Splunk/latest/Admin/eventtypesconf

HTH,

Dave

0 Karma

dshpritz
SplunkTrust
SplunkTrust

Are you able to find the error events that you want to count in your data?

0 Karma

Starky
Explorer

Thanks Dave.. But maybe becuase i am such a newb.. i am still lost.. I have about 100 cisco switches and routers across MPLS.. But i want to see the to 10 devices give the most errors over a 7 days period. I have a deadline i am trying to meet for Tuesday and i am really stuck.
Thank you in advance.

0 Karma

Starky
Explorer

I want to see the cisco devices that has the most input/output errors over a 7 days period. The below is for one of my devices.

Total Counters since 01/17/13 04:30 PM EST
286663 input errors, 0 output errors
0 input discards, 0 output discards
11570 interface resets, 69 carrier transitions

0 Karma

Damien_Dallimor
Ultra Champion

Can you provide a sample of your logs ?

Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...