Splunk Search

How to count top results in each column?

marisstella
Explorer

Hi everyone,
Trying to find out the top 10 values from different host long_message index functionality..
So tried like index=* "error" OR "FAIL" OR "fatal"| stats values (functionality) values(correlatioid) values(loan_num) values(host) count by log_message | sort -count

So it is showing top errors with functionality host loan_num details for each and every error.
My requirement is i want achieve top errors count from particular host or fuctionality..
It is showing like
Functionality:
Abc
Xyz
123
Let's say If the Abc functionality has more errors.. in the table it should give the count of Abc along with percentage among all the obtained errors..
Like this..
Functionality:
Abc- 109 98% amoung
Xyz - 1 1%
123 1 1%

Any suggestions?
Similarly i want see the top errors causing from different sources..

0 Karma

to4kawa
Ultra Champion

your query:

 index=* "error" OR "FAIL" OR "fatal"
| stats values(functionality) values(correlatioid) values(loan_num) values(host) count by log_message 
| sort - count

Simply:

 index=* "error" OR "FAIL" OR "fatal"
| top functionality
0 Karma

marisstella
Explorer

how it will show the count for each row in functionality column?

0 Karma

to4kawa
Ultra Champion

the result of top is like below

functionality count percent
Abc                109     98%
Xyz                  1      1%
123                  1      1%

cf. top

0 Karma

marisstella
Explorer

How can we compare these values by log messages?
Let's say there is an error 501..
I need table like this..

Log_message. Functionality: host:

Error-501 abc 98 98%. Bjk500. 70 70%
Xyz 01 1%. Bjk400. 20 20%
123 01 1%. Bjk300. 10 10%

Like that we want correlate all sources with the specifyerror..

0 Karma

to4kawa
Ultra Champion

I don't know the details of your logs.
so , I can't create query.

0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...