print the error code count

[ajaynaralikar]

I want to create the dashboard to show error count for specific execution group on specific broker, Below is the query,

index=BEM source="/apps/wmb/brokerlogs/mqsi.log" mbReturnCode="*" |table mbReturnCode mbBrokerName mbExecutingGroupName
I have getting below result,
mbReturnCode mbBrokerName mbExecutingGroupName
1 BIP2604 BK_MQLP37LB BEM_CARD_SERVICES
2 BIP2623 BK_MQLP37LB BEM_CARD_SERVICES
3 BIP2604 BK_MQLP37LB BEM_CARD_SERVICES
4 BIP2623 BK_MQLP37LB BEM_CARD_SERVICES

But require below one
mbReturnCode mbBrokerName mbExecutingGroupName Count(*)
1 BIP2604 BK_MQLP37LB BEM_CARD_SERVICES 115
2 BIP2623 BK_MQLP01LB Payment 96
3 BIP2545 BK_MQLP02LB Merchant_mgt 44

Could you please help me.

Splunk version- 6.5.0

[HiroshiSatoh · Accepted solution]

Try this!

index=BEM source="/apps/wmb/brokerlogs/mqsi.log" mbReturnCode="*" 
|stats count by mbReturnCode,mbBrokerName,mbExecutingGroupName

[HiroshiSatoh]

|stats count by mbReturnCode,mbBrokerName,mbExecutingGroupName
↓
|top limit=20 mbReturnCode,mbBrokerName,mbExecutingGroupName

[lfedak_splunk]

Hey @ajaynaralikar, Please be sure that when responding to someone's answer, click on "Add comment" directly below their answer or, if responding to someone's comment, type in the "Add your comment..." box directly below their comment. You typed your last response in the "Enter your answer here..." box at the very bottom of the page which, instead, posted a brand new answer. This will help with a clean continuous flow of the conversation. I already converted your "answer" to comments, so just something to keep in mind from here on out. Thanks and happy Splunking!

[ajaynaralikar]

Sure.
Next time will follow this.

[ajaynaralikar]

Thanks HiroshiSatoh.
Could you please do one more help.
I want to print top 20 count value in sorted order