Security

Devices with the most error

Starky
Explorer

Hello,
I am new to splunk and would like some help in displaying the top devices on my network that produces the most error. Can someone assist??

Tags (4)
0 Karma

dshpritz
SplunkTrust
SplunkTrust

Your best bet would be to find your error events, and then create eventtypes for them. You would then be able to search for the eventtype, and get a count of the hosts. For example:

index=firewall eventtype=fw_input_errors | stats count by host

For the time period you can use the time picker, or add it to the search:

earliest=-7d latest=now index=firewall eventtype=fw_input_errors | stats count by host

More on eventtypes:

http://docs.splunk.com/Documentation/Splunk/latest/knowledge/Defineeventtypes

http://docs.splunk.com/Documentation/Splunk/latest/Admin/eventtypesconf

HTH,

Dave

0 Karma

dshpritz
SplunkTrust
SplunkTrust

Are you able to find the error events that you want to count in your data?

0 Karma

Starky
Explorer

Thanks Dave.. But maybe becuase i am such a newb.. i am still lost.. I have about 100 cisco switches and routers across MPLS.. But i want to see the to 10 devices give the most errors over a 7 days period. I have a deadline i am trying to meet for Tuesday and i am really stuck.
Thank you in advance.

0 Karma

Starky
Explorer

I want to see the cisco devices that has the most input/output errors over a 7 days period. The below is for one of my devices.

Total Counters since 01/17/13 04:30 PM EST
286663 input errors, 0 output errors
0 input discards, 0 output discards
11570 interface resets, 69 carrier transitions

0 Karma

Damien_Dallimor
Ultra Champion

Can you provide a sample of your logs ?

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...