Table ordered by OID occurrence count

[splunk_zen]

Hi,
what would be the SPL to return a table ordered by most common oid, server ?

2014-02-11 17:09:23,855 ERROR SNMP get returned empty value: SWITCH-UAT-07 1.3.6.1.4.1.9.9.117.1.1.2.1.3.104000023

2014-02-11 16:06:01,655 ERROR SNMP get returned empty value: server-prd-01 1.3.6.1.4.1.232.6.2.6.8.1.6.1.9

2014-02-11 14:48:26,846 ERROR SNMP get returned empty value: SWITCH-US1 1.3.6.1.2.1.31.1.1.1.11.5

[somesoni2 · Accepted solution]

Try this:

sourcetype=yoursourcetype | rex "(?i) value: (?P<server>[^ ]+) (?P<oid>.*)" | table _time, server, oid | stats count by server,oid | sort -count

[splunk_zen]

Simple and effective,
thanks !

[lukejadamec]

Which value is the oid?

Is the oid already extracted as a field?