Splunk Search

How to count top results in each column?

marisstella
Explorer

Hi everyone,
Trying to find out the top 10 values from different host long_message index functionality..
So tried like index=* "error" OR "FAIL" OR "fatal"| stats values (functionality) values(correlatioid) values(loan_num) values(host) count by log_message | sort -count

So it is showing top errors with functionality host loan_num details for each and every error.
My requirement is i want achieve top errors count from particular host or fuctionality..
It is showing like
Functionality:
Abc
Xyz
123
Let's say If the Abc functionality has more errors.. in the table it should give the count of Abc along with percentage among all the obtained errors..
Like this..
Functionality:
Abc- 109 98% amoung
Xyz - 1 1%
123 1 1%

Any suggestions?
Similarly i want see the top errors causing from different sources..

0 Karma

to4kawa
Ultra Champion

your query:

 index=* "error" OR "FAIL" OR "fatal"
| stats values(functionality) values(correlatioid) values(loan_num) values(host) count by log_message 
| sort - count

Simply:

 index=* "error" OR "FAIL" OR "fatal"
| top functionality
0 Karma

marisstella
Explorer

how it will show the count for each row in functionality column?

0 Karma

to4kawa
Ultra Champion

the result of top is like below

functionality count percent
Abc                109     98%
Xyz                  1      1%
123                  1      1%

cf. top

0 Karma

marisstella
Explorer

How can we compare these values by log messages?
Let's say there is an error 501..
I need table like this..

Log_message. Functionality: host:

Error-501 abc 98 98%. Bjk500. 70 70%
Xyz 01 1%. Bjk400. 20 20%
123 01 1%. Bjk300. 10 10%

Like that we want correlate all sources with the specifyerror..

0 Karma

to4kawa
Ultra Champion

I don't know the details of your logs.
so , I can't create query.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...