Splunk Search

Top errors with hosts

jamesklassen
Path Finder

I have a search that sends me the top 10 errors on all of our servers each morning:

error OR Error OR alert OR Alert OR fail* OR Fail* source="WMI:WinEventLog*" | top limit=10 Message

But this would be much more helpful if I could, for each error, see which server(s) it has occurred on.

I assume I need to run a subsearch to figure out which server(s) the error has ocurred?

Tags (1)
0 Karma
1 Solution

southeringtonp
Motivator

Using a subsearch is overkill -- use stats instead. Something like the following should work.

error OR alert OR fail source="WMI:WinEventLog*"
| stats count values(host) by Message
| sort - count
| head 10

View solution in original post

mfrost8
Builder

Unless I'm mistaken, the strings you're searching for are case-insensitive. In fact, I had asked this a while back, but I don't think you can have Splunk do a case-sensitive search. So in your case, you really only need

error OR alert OR fail ...

0 Karma

southeringtonp
Motivator

Using a subsearch is overkill -- use stats instead. Something like the following should work.

error OR alert OR fail source="WMI:WinEventLog*"
| stats count values(host) by Message
| sort - count
| head 10

jamesklassen
Path Finder

Perfect, thank you

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...