How to search top 10 error codes in an environment?

[ss78246]

Hi.

I am new to Splunk and was looking for a search which can give me the list of the top 10 error codes occurring in an environment. Could anyone suggest on this?

I think I have to use stats and top commands, but not sure on how to list top 10 error codes.

Regards.

[sundareshr]

Assuming you have the err_cd field extracted, you just need to top command. Try something like this

your base search here | top err_cd | fields - count

This will give you top 10 err_cd, count and percent. The fields - count command will remove the count field from display.

http://docs.splunk.com/Documentation/Splunk/6.4.1/SearchReference/Top

[ss78246]

HI Sundaresh.

Thanks for the update.
I am searching for error codes from log files in an environment.
How could I separate out only error code from the logs .
I mean error codes can be like err20 or err31 , just an example.

And also could you suggest on how I can use error code as field in top command.