Splunk Search

Grouping top occurring events.

kbharatunix
New Member

I have below fields on so i would like group top occurring events

like sort by severity critical and display message

top messages with IP etc.

customerID 15
dateUpdated 29
initialResolution 1
issueSeverity 331
sourcetype 2
status 2
summary 36
supportType 2
ticketID 37
accountName 11
csrName
customerEmail 15
dateClosed

Any help would be much appreciated .

Tags (3)
0 Karma

woodcock
Esteemed Legend

I am not sure I understand your message but perhaps you are looking for the contingency command which you use like this:

... | contingency issueSeverity IP
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...