How to count a specified keyword?

[dikaye]

I have some syslog string like that:

Jan 29 14:26:12 10.9.8.10 Jan 29 14:06:32 C420-PLOI91903V0YL fault-engined: %CIMC-3-EQUIPMENT_INOPERABLE:[F0531][major][equipment-inoperable][sys/rack-unit-1/board/storage-SAS-SLOT-3/raid-battery] Storage Raid Battery SLOT-3 is inoperable: Check Controller battery 
Jan 29 14:26:11 10.9.8.10 Jan 29 14:06:31 C420-PLOI91903V0YL fault-engined: %CIMC-2-EQUIPMENT_INOPERABLE:[F1007][critical][equipment-inoperable][sys/rack-unit-1/board/storage-SAS-SLOT-3/vd-0] Storage Virtual Drive 0 is inoperable: Check storage controller, or reseat the storage drive 
Jan 29 14:26:10 10.9.8.10 Jan 29 14:06:30 C420-PLOI91903V0YL fault-engined: %CIMC-2-EQUIPMENT_INOPERABLE:[F1004][critical][equipment-inoperable][sys/rack-unit-1/board/storage-SAS-SLOT-3] Storage controller SLOT-3 inoperable: reseat or replace the storage controller SLOT-3 
Jan 29 14:26:01 10.9.8.10 Jan 29 14:06:21 C420-PLOI91903V0YL fault-engined: %CIMC-3-EQUIPMENT_INOPERABLE:[F0531][major][equipment-inoperable][sys/rack-unit-1/board/storage-SAS-SLOT-3/raid-battery] Storage Raid Battery SLOT-3 is inoperable: Check Controller battery 
Jan 29 14:26:00 10.9.8.10 Jan 29 14:06:20 C420-PLOI91903V0YL fault-engined: %CIMC-2-EQUIPMENT_INOPERABLE:[F1007][critical][equipment-inoperable][sys/rack-unit-1/board/storage-SAS-SLOT-3/vd-0] Storage Virtual Drive 0 is inoperable: Check storage controller, or reseat the storage drive 
Jan 29 14:25:59 10.9.8.10 Jan 29 14:06:19 C420-PLOI91903V0YL fault-engined: %CIMC-2-EQUIPMENT_INOPERABLE:[F1004][critical][equipment-inoperable][sys/rack-unit-1/board/storage-SAS-SLOT-3] Storage controller SLOT-3 inoperable: reseat or replace the storage controller SLOT-3 
Jan 29 14:25:50 10.9.8.10 Jan 29 14:06:10 C420-PLOI91903V0YL fault-engined: %CIMC-3-EQUIPMENT_INOPERABLE:[F0531][major][equipment-inoperable][sys/rack-unit-1/board/storage-SAS-SLOT-3/raid-battery] Storage Raid Battery SLOT-3 is inoperable: Check Controller battery 
Jan 29 14:25:49 10.9.8.10 Jan 29 14:06:09 C420-PLOI91903V0YL fault-engined: %CIMC-2-EQUIPMENT_INOPERABLE:[F1007][critical][equipment-inoperable][sys/rack-unit-1/board/storage-SAS-SLOT-3/vd-0] Storage Virtual Drive 0 is inoperable: Check storage controller, or reseat the storage drive 
Jan 29 14:25:48 10.9.8.10 Jan 29 14:06:08 C420-PLOI91903V0YL fault-engined: %CIMC-2-EQUIPMENT_INOPERABLE:[F1004][critical][equipment-inoperable][sys/rack-unit-1/board/storage-SAS-SLOT-3] Storage controller SLOT-3 inoperable: reseat or replace the storage controller SLOT-3 
Jan 29 14:16:40 10.9.8.10 Jan 29 13:57:01 C420-PLOI91903V0YL fault-engined: %CIMC-3-EQUIPMENT_INOPERABLE:[F0531][major][equipment-inoperable][sys/rack-unit-1/board/storage-SAS-SLOT-3/raid-battery] Storage Raid Battery SLOT-3 is inoperable: Check Controller battery 
Jan 29 14:16:39 10.9.8.10 Jan 29 13:57:00 C420-PLOI91903V0YL fault-engined: %CIMC-2-EQUIPMENT_INOPERABLE:[F1007][critical][equipment-inoperable][sys/rack-unit-1/board/storage-SAS-SLOT-3/vd-0] Storage Virtual Drive 0 is inoperable: Check storage controller, or reseat the storage drive 
Jan 29 14:16:38 10.9.8.10 Jan 29 13:56:59 C420-PLOI91903V0YL fault-engined: %CIMC-2-EQUIPMENT_INOPERABLE:[F1004][critical][equipment-inoperable][sys/rack-unit-1/board/storage-SAS-SLOT-3] Storage controller SLOT-3 inoperable: reseat or replace the storage controller SLOT-3 
Jan 29 13:58:31 10.9.8.10 Jan 29 13:38:51 C420-PLOI91903V0YL fault-engined: %CIMC-3-EQUIPMENT_INOPERABLE:[F0531][major][equipment-inoperable][sys/rack-unit-1/board/storage-SAS-SLOT-3/raid-battery] Storage Raid Battery SLOT-3 is inoperable: Check Controller battery 
Jan 29 13:58:30 10.9.8.10 Jan 29 13:38:50 C420-PLOI91903V0YL fault-engined: %CIMC-2-EQUIPMENT_INOPERABLE:[F1007][critical][equipment-inoperable][sys/rack-unit-1/board/storage-SAS-SLOT-3/vd-0] Storage Virtual Drive 0 is inoperable: Check storage controller, or reseat the storage drive 
Jan 29 13:58:29 10.9.8.10 Jan 29 13:38:49 C420-PLOI91903V0YL fault-engined: %CIMC-2-EQUIPMENT_INOPERABLE:[F1004][critical][equipment-inoperable][sys/rack-unit-1/board/storage-SAS-SLOT-3] Storage controller SLOT-3 inoperable: reseat or replace the storage controlle

Now, I want to count the top 10 by the error code which is "F0531", "F1004", "F1004" .......

How to do it?

Many thanks.

[renjith_nair]

Extract the field from the raw event (either using props and transforms or using field extraction in UI)

Try below

your search |rex field=_raw "^[^\[\n]*\[(?P<ErrorCode>[^\]]+)"|top ErrorCode

Adjust the regex to make it accurate with your events.

Reference :

http://docs.splunk.com/Documentation/Splunk/6.0/Knowledge/ExtractfieldsinteractivelywithIFX
http://docs.splunk.com/Documentation/Splunk/6.2.0/Knowledge/Createandmaintainsearch-timefieldextract...