Splunk Search

How to display current and previous ranks of top 10 error messages with the respective count and percentage contribution on daily basis.

abhi_syntel_hum
New Member

Hi,

Initially I tried with:

ConsumerService HostEnvironmentName=PROD| top limit=10 message

to get the daily details, then to display current rank modified with:

ConsumerService HostEnvironmentName=PROD| top limit=10 message | streamstats count as C.Rank

but I am struggling to get the ranks of top 10 messages for previous day,

Please guide me to right direction.

Abhishek

0 Karma
1 Solution

sundareshr
Legend

See if this gives you what you're looking for

index=_internal sourcetype=*web* earliest=-1d@d | top 100 uri | streamstats count as "Yesterday's Rank" | where [ search index=_internal sourcetype=*web* earliest=@d | top 10 uri | table uri] | rename percent as "Yesterday's Percent" | appendcols [ search index=_internal sourcetype=*web* earliest=@d | top 10 uri ] | streamstats count as "Today's Rank" | rename percent as "Today's Percent" | fields - count

View solution in original post

0 Karma

sundareshr
Legend

See if this gives you what you're looking for

index=_internal sourcetype=*web* earliest=-1d@d | top 100 uri | streamstats count as "Yesterday's Rank" | where [ search index=_internal sourcetype=*web* earliest=@d | top 10 uri | table uri] | rename percent as "Yesterday's Percent" | appendcols [ search index=_internal sourcetype=*web* earliest=@d | top 10 uri ] | streamstats count as "Today's Rank" | rename percent as "Today's Percent" | fields - count
0 Karma

abhi_syntel_hum
New Member

Thanks sundareshr for quick response.
The solution is perfect. I needed error counts also, so I replaced fields - count -> rename count as Count
Thanks again !!

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Enterprise 9.4: Features to Power Your Digital Resilience

Hey Splunky People! We are excited to share the latest updates in Splunk Enterprise 9.4. In this release we ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...