I have some syslog string like that:
Jan 29 14:26:12 10.9.8.10 Jan 29 14:06:32 C420-PLOI91903V0YL fault-engined: %CIMC-3-EQUIPMENT_INOPERABLE:[F0531][major][equipment-inoperable][sys/rack-unit-1/board/storage-SAS-SLOT-3/raid-battery] Storage Raid Battery SLOT-3 is inoperable: Check Controller battery
Jan 29 14:26:11 10.9.8.10 Jan 29 14:06:31 C420-PLOI91903V0YL fault-engined: %CIMC-2-EQUIPMENT_INOPERABLE:[F1007][critical][equipment-inoperable][sys/rack-unit-1/board/storage-SAS-SLOT-3/vd-0] Storage Virtual Drive 0 is inoperable: Check storage controller, or reseat the storage drive
Jan 29 14:26:10 10.9.8.10 Jan 29 14:06:30 C420-PLOI91903V0YL fault-engined: %CIMC-2-EQUIPMENT_INOPERABLE:[F1004][critical][equipment-inoperable][sys/rack-unit-1/board/storage-SAS-SLOT-3] Storage controller SLOT-3 inoperable: reseat or replace the storage controller SLOT-3
Jan 29 14:26:01 10.9.8.10 Jan 29 14:06:21 C420-PLOI91903V0YL fault-engined: %CIMC-3-EQUIPMENT_INOPERABLE:[F0531][major][equipment-inoperable][sys/rack-unit-1/board/storage-SAS-SLOT-3/raid-battery] Storage Raid Battery SLOT-3 is inoperable: Check Controller battery
Jan 29 14:26:00 10.9.8.10 Jan 29 14:06:20 C420-PLOI91903V0YL fault-engined: %CIMC-2-EQUIPMENT_INOPERABLE:[F1007][critical][equipment-inoperable][sys/rack-unit-1/board/storage-SAS-SLOT-3/vd-0] Storage Virtual Drive 0 is inoperable: Check storage controller, or reseat the storage drive
Jan 29 14:25:59 10.9.8.10 Jan 29 14:06:19 C420-PLOI91903V0YL fault-engined: %CIMC-2-EQUIPMENT_INOPERABLE:[F1004][critical][equipment-inoperable][sys/rack-unit-1/board/storage-SAS-SLOT-3] Storage controller SLOT-3 inoperable: reseat or replace the storage controller SLOT-3
Jan 29 14:25:50 10.9.8.10 Jan 29 14:06:10 C420-PLOI91903V0YL fault-engined: %CIMC-3-EQUIPMENT_INOPERABLE:[F0531][major][equipment-inoperable][sys/rack-unit-1/board/storage-SAS-SLOT-3/raid-battery] Storage Raid Battery SLOT-3 is inoperable: Check Controller battery
Jan 29 14:25:49 10.9.8.10 Jan 29 14:06:09 C420-PLOI91903V0YL fault-engined: %CIMC-2-EQUIPMENT_INOPERABLE:[F1007][critical][equipment-inoperable][sys/rack-unit-1/board/storage-SAS-SLOT-3/vd-0] Storage Virtual Drive 0 is inoperable: Check storage controller, or reseat the storage drive
Jan 29 14:25:48 10.9.8.10 Jan 29 14:06:08 C420-PLOI91903V0YL fault-engined: %CIMC-2-EQUIPMENT_INOPERABLE:[F1004][critical][equipment-inoperable][sys/rack-unit-1/board/storage-SAS-SLOT-3] Storage controller SLOT-3 inoperable: reseat or replace the storage controller SLOT-3
Jan 29 14:16:40 10.9.8.10 Jan 29 13:57:01 C420-PLOI91903V0YL fault-engined: %CIMC-3-EQUIPMENT_INOPERABLE:[F0531][major][equipment-inoperable][sys/rack-unit-1/board/storage-SAS-SLOT-3/raid-battery] Storage Raid Battery SLOT-3 is inoperable: Check Controller battery
Jan 29 14:16:39 10.9.8.10 Jan 29 13:57:00 C420-PLOI91903V0YL fault-engined: %CIMC-2-EQUIPMENT_INOPERABLE:[F1007][critical][equipment-inoperable][sys/rack-unit-1/board/storage-SAS-SLOT-3/vd-0] Storage Virtual Drive 0 is inoperable: Check storage controller, or reseat the storage drive
Jan 29 14:16:38 10.9.8.10 Jan 29 13:56:59 C420-PLOI91903V0YL fault-engined: %CIMC-2-EQUIPMENT_INOPERABLE:[F1004][critical][equipment-inoperable][sys/rack-unit-1/board/storage-SAS-SLOT-3] Storage controller SLOT-3 inoperable: reseat or replace the storage controller SLOT-3
Jan 29 13:58:31 10.9.8.10 Jan 29 13:38:51 C420-PLOI91903V0YL fault-engined: %CIMC-3-EQUIPMENT_INOPERABLE:[F0531][major][equipment-inoperable][sys/rack-unit-1/board/storage-SAS-SLOT-3/raid-battery] Storage Raid Battery SLOT-3 is inoperable: Check Controller battery
Jan 29 13:58:30 10.9.8.10 Jan 29 13:38:50 C420-PLOI91903V0YL fault-engined: %CIMC-2-EQUIPMENT_INOPERABLE:[F1007][critical][equipment-inoperable][sys/rack-unit-1/board/storage-SAS-SLOT-3/vd-0] Storage Virtual Drive 0 is inoperable: Check storage controller, or reseat the storage drive
Jan 29 13:58:29 10.9.8.10 Jan 29 13:38:49 C420-PLOI91903V0YL fault-engined: %CIMC-2-EQUIPMENT_INOPERABLE:[F1004][critical][equipment-inoperable][sys/rack-unit-1/board/storage-SAS-SLOT-3] Storage controller SLOT-3 inoperable: reseat or replace the storage controlle
Now, I want to count the top 10 by the error code which is "F0531", "F1004", "F1004" .......
How to do it?
Many thanks.
Extract the field from the raw event (either using props and transforms or using field extraction in UI)
Try below
your search |rex field=_raw "^[^\[\n]*\[(?P<ErrorCode>[^\]]+)"|top ErrorCode
Adjust the regex to make it accurate with your events.
Reference :
http://docs.splunk.com/Documentation/Splunk/6.0/Knowledge/ExtractfieldsinteractivelywithIFX
http://docs.splunk.com/Documentation/Splunk/6.2.0/Knowledge/Createandmaintainsearch-timefieldextract...