Splunk Search
Highlighted

how can I create a top 5 list of multiple values from one source

Path Finder

I have an index from a forwarder that looks something like this:
"index=indexname DEBUG Rule="Rule One" OR "Rule Two" OR "Rule Three" etc."
I'd like to build a summary of all the Rules that come in via the log that is being read by the forwarder. Something like a top 5 summary of Rules that came out. I've tried to parse through a lookup table, but that didn't do what I wanted. Having difficulty with something that should be pretty easy.

Tags (2)
0 Karma
Highlighted

Re: how can I create a top 5 list of multiple values from one source

SplunkTrust
SplunkTrust

You need to define the rule based on which you want to find the top 5 rules. Example, if you want to find out top 5 Rule based on number of events, you can do like this

index=indexname DEBUG Rule="Rule One" OR Rule="Rule Two" OR Rule="Rule Three"...all rules that you're interested in..
| top 5 Rule
Highlighted

Re: how can I create a top 5 list of multiple values from one source

Path Finder

Thanks for the info. A lookup table is what I need, which I had defined, but it wasn't right. However, I still need something else.

0 Karma
Highlighted

Re: how can I create a top 5 list of multiple values from one source

SplunkTrust
SplunkTrust

okay so I think your question is regarding there are multiple values for a field Rule .

step1 :so what you can do is, you can create mylookup.csv in which you will have column Rule and values i.e. Rule one two three, etc you need to search

step 2 :add this lookup table using this doc
https://docs.splunk.com/Documentation/Splunk/7.0.1/PivotTutorial/AddlookupfilestoSplunk

step 3 :and the write your search query as follows:

index=indexname DEBUG [inputlookup mylookup.csv] | top limit=5 Rule

which means that your search will actually run as

index=indexname DEBUG Rule="Rule One" OR "Rule Two" OR "Rule Three" etc.." | top limit=5 Rule

you can see this search in job>>inspect job>>saerch job propertise>>normalized search
Let me know if this helps!

Highlighted

Re: how can I create a top 5 list of multiple values from one source

Path Finder

Thanks for the help. I did build a lookup table and added it, but still not seeing any results. My lookup looks like this. I thought about quotes around the :

Rule,Values
1,Questionable Radio Link
2,Bad Cable
3,Data Abuser Warning
etc.
I inspected the job, but I don't see anything glaring except it's not finding anything. But at least this tells me I was on the right track. I'll keep poking.

0 Karma
Highlighted

Re: how can I create a top 5 list of multiple values from one source

SplunkTrust
SplunkTrust

I am assuming in your logs you have Rule=“bad cable” and so on format right?
If it is then why does your lookup contain 2 columns...
Build a lookup that have only one column just like in splunk ...
In splunk if you have Field name as Rule and value as Bad cable

Then your lookup should have only one column i.e
Rule
Bad Cable
Questionable radio link
...
And so..

Keep column name of csv same as field name in splunk

I hope this helps you!

0 Karma
Highlighted

Re: how can I create a top 5 list of multiple values from one source

Path Finder

Yeah, unfortunately, I'd already tried both of your suggestions before I even opened this question and answer. I thought you were on to something with having 2 columns. Hmmm, I know I'm close.

0 Karma
Highlighted

Re: how can I create a top 5 list of multiple values from one source

SplunkTrust
SplunkTrust

This method is 100 percent working . Just that you need to match fields and value properly .
Yes even i feel this is the better method try and accept the answer which helped to get the work done !

0 Karma
Highlighted

Re: how can I create a top 5 list of multiple values from one source

Path Finder

I will as soon as I can get it to work.

Thanks

0 Karma
Highlighted

Re: how can I create a top 5 list of multiple values from one source

SplunkTrust
SplunkTrust

If your lookup has two columns and one of them (column Values) match, exactly, Rule field in your raw data, you can run like this

index=indexname DEBUG [inputlookup mylookup.csv | table Values | rename Values as Rule] | top limit=5 Rule