Splunk Search

How to augment |top output with additional searches/results?

lensammus
New Member

I'd like to combine/add/include the results of a search to each item of a top 10 search

for data like:
msg="error asdf" host=server1
msg="error zxcv" host=server1
msg="error qwer" host=server2
msg="error zxcv" host=server2
msg="error zxcv" host=server2

I'd like to end up with output like:
(A top 10 of the msg's found, and then the top hosts in another colum per msg, ideally with a count of both msg's and hosts per msg)

Columns: [msg], [total msg count], [hosts sorted by count, and with :count if possible]
error zxcv, 3, server2:2 server1:1
error asdf, 1, server1:1
error qwer, 1, server2:1

I wouldn't care if the hosts and counts got their own line like a values() or having to do a dashboard with a query per top msg (although I'm not sure how to specify the non first result of a | top command either)

Anyway, this lets me know where my errors are, and which servers are having more of them and an idea of how many, which cuts out a step in investigation and makes much more useful externally facing reports

I can get close for the first row with a subsearch and a value() but the data returned only applies to row 1's msg value
Programmaticly it would be something like, for each of the top 10 errors, print the hosts that match the msg field in order and with a count

Tags (1)
0 Karma
1 Solution

lguinn2
Legend

Try this

yoursearchhere
| top host by msg | eventstats sum(count) as msgtotal by msg 
| sort -msgtotal -count 
| stats first(msgtotal) as "Total Message Count" list(host) as "Top Hosts" list(count) as "Top Message Counts by Host" by msg

View solution in original post

0 Karma

lguinn2
Legend

Try this

yoursearchhere
| top host by msg | eventstats sum(count) as msgtotal by msg 
| sort -msgtotal -count 
| stats first(msgtotal) as "Total Message Count" list(host) as "Top Hosts" list(count) as "Top Message Counts by Host" by msg
0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...