Top errors with hosts

[jamesklassen]

I have a search that sends me the top 10 errors on all of our servers each morning:

error OR Error OR alert OR Alert OR fail* OR Fail* source="WMI:WinEventLog*" | top limit=10 Message

But this would be much more helpful if I could, for each error, see which server(s) it has occurred on.

I assume I need to run a subsearch to figure out which server(s) the error has ocurred?

[mfrost8]

Unless I'm mistaken, the strings you're searching for are case-insensitive. In fact, I had asked this a while back, but I don't think you can have Splunk do a case-sensitive search. So in your case, you really only need

error OR alert OR fail ...

[southeringtonp · Accepted solution]

Using a subsearch is overkill -- use stats instead. Something like the following should work.

error OR alert OR fail source="WMI:WinEventLog*"
| stats count values(host) by Message
| sort - count
| head 10

[jamesklassen]

Perfect, thank you