I run this search
source="secure" sshd "pam_ldap: error trying to bind as user"|top uid limit=10
which then shows me the top 10 login failures and how many failures they had but I also want it to display the host that failures where on so they are included in the email but I am not sure how to do this?
Might be easier to not use the 'top' command to get this information.
i.e.
source="secure" sshd "pam_ldap: error trying to bind as user"
| stats count values(host) as hosts by uid | sort - count | head 10
Update :
here's a search that going to return data - its the same concept..
index=_internal sourcetype=splunkd earliest=-1h@h latest=@h | bin _time span=15m
| stats count values(_time) as times by group | sort - count | head 10
In that case there's no data returned by the 1st part of the search. See update
Thanks but when I run that it returns no results.