Hi,
what would be the SPL to return a table ordered by most common oid, server ?
2014-02-11 17:09:23,855 ERROR SNMP get returned empty value: SWITCH-UAT-07 1.3.6.1.4.1.9.9.117.1.1.2.1.3.104000023
2014-02-11 16:06:01,655 ERROR SNMP get returned empty value: server-prd-01 1.3.6.1.4.1.232.6.2.6.8.1.6.1.9
2014-02-11 14:48:26,846 ERROR SNMP get returned empty value: SWITCH-US1 1.3.6.1.2.1.31.1.1.1.11.5
Try this:
sourcetype=yoursourcetype | rex "(?i) value: (?P<server>[^ ]+) (?P<oid>.*)" | table _time, server, oid | stats count by server,oid | sort -count
Try this:
sourcetype=yoursourcetype | rex "(?i) value: (?P<server>[^ ]+) (?P<oid>.*)" | table _time, server, oid | stats count by server,oid | sort -count
Simple and effective,
thanks !
Which value is the oid?
Is the oid already extracted as a field?