Splunk Search
Highlighted

Newbie question - top(field1) by field2?

Engager

I have a large log of items that come from different machines. Each machine generates some set of errors. I want to see the top 10 errors for each machine.

in my mental splunk-pseudocode, I thought something like this:

machine="linux6.*" error="*Exception" | top (error) by machine

would produce:

linux6.1 NullPointerException     7699
linux6.1 InvalidArgumentException 7102
linux6.2 NullPointerException     909
linux6.2 InvalidArgumentException 1019

I'm really new to splunk, please help!

Tags (1)
0 Karma
Highlighted

Re: Newbie question - top(field1) by field2?

Motivator

If error is the field , tat contains error messages..

your search | top error by machine

would give u top ten errors for each machine.

0 Karma
Highlighted

Re: Newbie question - top(field1) by field2?

Splunk Employee
Splunk Employee

machine="linux6.*" error="*Exception" | top error by machine

Highlighted

Re: Newbie question - top(field1) by field2?

Engager

Ugh, it was just the parenthesis? I'm a moron 😞
Thanks!

Highlighted

Re: Newbie question - top(field1) by field2?

Super Champion

Try:

top machine,error
0 Karma