Splunk Search

Newbie question - top(field1) by field2?

kylar
Engager

I have a large log of items that come from different machines. Each machine generates some set of errors. I want to see the top 10 errors for each machine.

in my mental splunk-pseudocode, I thought something like this:

machine="linux6.*" error="*Exception" | top (error) by machine

would produce:

linux6.1 NullPointerException     7699
linux6.1 InvalidArgumentException 7102
linux6.2 NullPointerException     909
linux6.2 InvalidArgumentException 1019

I'm really new to splunk, please help!

Tags (1)
0 Karma

lukejadamec
Super Champion

Try:

top machine,error
0 Karma

_d_
Splunk Employee
Splunk Employee

machine="linux6.*" error="*Exception" | top error by machine

kylar
Engager

Ugh, it was just the parenthesis? I'm a moron 😞
Thanks!

rakesh_498115
Motivator

If error is the field , tat contains error messages..

your search | top error by machine

would give u top ten errors for each machine.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...