Splunk Search

Populating top 2 failed-policy counts for each cycledate

New Member

I am trying to write a search for getting the top two failed policy count for each cycledate. The below works for a single day but not for multiple cycledates.

index=xxx host=yy* source="*E:\\logfile\*" tag="*error*" "Error ==>*" | stats distinct_count(polnum) as FailedPolicy by error_message, err_code, cycledate | sort 2-FailedPolicy

 

Table without the sort 2 -FailedPolicy

error_ messageerr_CodeCycleDateFailedPolicy
Err1201670911202035
Err2234610911202012
Err3234510911202022
Err41324091120203
Err51341550910202021
Err632450910202081
Err71234091020202
Err841240909202021
Err95670909202031
Err1098730909202045
Labels (1)
0 Karma

Builder

It isn't clear whether your search includes a space between "-" and "FailedPolicy"

| sort 2 - FailedPolicy
0 Karma

SplunkTrust
SplunkTrust

The dedup command can select the first two events for each value of a given field.

index=xxx host=yy* source="*E:\\logfile\*" tag="*error*" "Error ==>*" 
| stats distinct_count(polnum) as FailedPolicy by error_message, err_code, cycledate 
| sort - FailedPolicy
| dedup 2 CycleDate
---
If this reply helps you, an upvote would be appreciated.
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!