Splunk Search
Highlighted

Top errors with hosts

Path Finder

I have a search that sends me the top 10 errors on all of our servers each morning:

error OR Error OR alert OR Alert OR fail* OR Fail* source="WMI:WinEventLog*" | top limit=10 Message

But this would be much more helpful if I could, for each error, see which server(s) it has occurred on.

I assume I need to run a subsearch to figure out which server(s) the error has ocurred?

Tags (1)
0 Karma
Highlighted

Re: Top errors with hosts

Motivator

Using a subsearch is overkill -- use stats instead. Something like the following should work.

error OR alert OR fail source="WMI:WinEventLog*"
| stats count values(host) by Message
| sort - count
| head 10

View solution in original post

Highlighted

Re: Top errors with hosts

Path Finder

Perfect, thank you

0 Karma
Highlighted

Re: Top errors with hosts

Builder

Unless I'm mistaken, the strings you're searching for are case-insensitive. In fact, I had asked this a while back, but I don't think you can have Splunk do a case-sensitive search. So in your case, you really only need

error OR alert OR fail ...

0 Karma