Security

print the error code count

ajaynaralikar
New Member

I want to create the dashboard to show error count for specific execution group on specific broker, Below is the query,

index=BEM source="/apps/wmb/brokerlogs/mqsi.log" mbReturnCode="*" |table mbReturnCode mbBrokerName mbExecutingGroupName
I have getting below result,
mbReturnCode mbBrokerName mbExecutingGroupName
1 BIP2604 BK_MQLP37LB BEM_CARD_SERVICES
2 BIP2623 BK_MQLP37LB BEM_CARD_SERVICES
3 BIP2604 BK_MQLP37LB BEM_CARD_SERVICES
4 BIP2623 BK_MQLP37LB BEM_CARD_SERVICES

But require below one
mbReturnCode mbBrokerName mbExecutingGroupName Count(*)
1 BIP2604 BK_MQLP37LB BEM_CARD_SERVICES 115
2 BIP2623 BK_MQLP01LB Payment 96
3 BIP2545 BK_MQLP02LB Merchant_mgt 44

Could you please help me.

Splunk version- 6.5.0

Tags (1)
0 Karma
1 Solution

HiroshiSatoh
Champion

Try this!

index=BEM source="/apps/wmb/brokerlogs/mqsi.log" mbReturnCode="*" 
|stats count by mbReturnCode,mbBrokerName,mbExecutingGroupName

View solution in original post

0 Karma

HiroshiSatoh
Champion

Try this!

index=BEM source="/apps/wmb/brokerlogs/mqsi.log" mbReturnCode="*" 
|stats count by mbReturnCode,mbBrokerName,mbExecutingGroupName
0 Karma

HiroshiSatoh
Champion

|stats count by mbReturnCode,mbBrokerName,mbExecutingGroupName

|top limit=20 mbReturnCode,mbBrokerName,mbExecutingGroupName

0 Karma

lfedak_splunk
Splunk Employee
Splunk Employee

Hey @ajaynaralikar, Please be sure that when responding to someone's answer, click on "Add comment" directly below their answer or, if responding to someone's comment, type in the "Add your comment..." box directly below their comment. You typed your last response in the "Enter your answer here..." box at the very bottom of the page which, instead, posted a brand new answer. This will help with a clean continuous flow of the conversation. I already converted your "answer" to comments, so just something to keep in mind from here on out. Thanks and happy Splunking!

ajaynaralikar
New Member

Sure.
Next time will follow this.

0 Karma

ajaynaralikar
New Member

Thanks HiroshiSatoh.
Could you please do one more help.
I want to print top 20 count value in sorted order

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...