Splunk Search

How to count top results in each column?

marisstella
Explorer

Hi everyone,
Trying to find out the top 10 values from different host long_message index functionality..
So tried like index=* "error" OR "FAIL" OR "fatal"| stats values (functionality) values(correlatioid) values(loan_num) values(host) count by log_message | sort -count

So it is showing top errors with functionality host loan_num details for each and every error.
My requirement is i want achieve top errors count from particular host or fuctionality..
It is showing like
Functionality:
Abc
Xyz
123
Let's say If the Abc functionality has more errors.. in the table it should give the count of Abc along with percentage among all the obtained errors..
Like this..
Functionality:
Abc- 109 98% amoung
Xyz - 1 1%
123 1 1%

Any suggestions?
Similarly i want see the top errors causing from different sources..

0 Karma

to4kawa
Ultra Champion

your query:

 index=* "error" OR "FAIL" OR "fatal"
| stats values(functionality) values(correlatioid) values(loan_num) values(host) count by log_message 
| sort - count

Simply:

 index=* "error" OR "FAIL" OR "fatal"
| top functionality
0 Karma

marisstella
Explorer

how it will show the count for each row in functionality column?

0 Karma

to4kawa
Ultra Champion

the result of top is like below

functionality count percent
Abc                109     98%
Xyz                  1      1%
123                  1      1%

cf. top

0 Karma

marisstella
Explorer

How can we compare these values by log messages?
Let's say there is an error 501..
I need table like this..

Log_message. Functionality: host:

Error-501 abc 98 98%. Bjk500. 70 70%
Xyz 01 1%. Bjk400. 20 20%
123 01 1%. Bjk300. 10 10%

Like that we want correlate all sources with the specifyerror..

0 Karma

to4kawa
Ultra Champion

I don't know the details of your logs.
so , I can't create query.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...