Splunk Search

Sort search results based on other log values

Path Finder

So I'm currently searching my jboss access logs for all 500 errors with " 500 ". I get all the results, but then I'd like to sort by how many there are for each URI returned. An example would be how do I get the search to break out the results by how many 500s there are for /ABC, how many for /123 and how many for /test. Thanks

Tags (1)
0 Karma
1 Solution

Motivator

you can use :

<your search> | top uri

<your search> | stats count by uri

you can add to this the following to sort the uri by order :

| sort - uri

View solution in original post

Motivator

you can use :

<your search> | top uri

<your search> | stats count by uri

you can add to this the following to sort the uri by order :

| sort - uri

View solution in original post