Splunk Search

How to search top 10 error codes in an environment?

New Member


I am new to Splunk and was looking for a search which can give me the list of the top 10 error codes occurring in an environment. Could anyone suggest on this?

I think I have to use stats and top commands, but not sure on how to list top 10 error codes.


Tags (3)
0 Karma


Assuming you have the err_cd field extracted, you just need to top command. Try something like this

your base search here | top err_cd | fields - count

This will give you top 10 err_cd, count and percent. The fields - count command will remove the count field from display.


0 Karma

New Member

HI Sundaresh.

Thanks for the update.
I am searching for error codes from log files in an environment.
How could I separate out only error code from the logs .
I mean error codes can be like err20 or err31 , just an example.

And also could you suggest on how I can use error code as field in top command.

0 Karma