Splunk Search
Highlighted

Table ordered by OID occurrence count

Builder

Hi,
what would be the SPL to return a table ordered by most common oid, server ?

2014-02-11 17:09:23,855 ERROR SNMP get returned empty value: SWITCH-UAT-07 1.3.6.1.4.1.9.9.117.1.1.2.1.3.104000023

2014-02-11 16:06:01,655 ERROR SNMP get returned empty value: server-prd-01 1.3.6.1.4.1.232.6.2.6.8.1.6.1.9

2014-02-11 14:48:26,846 ERROR SNMP get returned empty value: SWITCH-US1 1.3.6.1.2.1.31.1.1.1.11.5

Tags (2)
0 Karma
Highlighted

Re: Table ordered by OID occurrence count

Super Champion

Which value is the oid?

Is the oid already extracted as a field?

0 Karma
Highlighted

Re: Table ordered by OID occurrence count

SplunkTrust
SplunkTrust

Try this:

sourcetype=yoursourcetype | rex "(?i) value: (?P<server>[^ ]+) (?P<oid>.*)" | table _time, server, oid | stats count by server,oid | sort -count

View solution in original post

Highlighted

Re: Table ordered by OID occurrence count

Builder

Simple and effective,
thanks !

0 Karma