Refine your search:

So I'm currently searching my jboss access logs for all 500 errors with " 500 ". I get all the results, but then I'd like to sort by how many there are for each URI returned. An example would be how do I get the search to break out the results by how many 500s there are for /ABC, how many for /123 and how many for /test. Thanks

asked 24 Feb '12, 07:47

DFresh4130's gravatar image

DFresh4130
311
accept rate: 0%


One Answer:

you can use :

<your search> | top uri

<your search> | stats count by uri

you can add to this the following to sort the uri by order :

| sort - uri
link

answered 24 Feb '12, 08:10

MarioM's gravatar image

MarioM
2.7k47
accept rate: 20%

edited 24 Feb '12, 08:24

Post your answer
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×55

Asked: 24 Feb '12, 07:47

Seen: 599 times

Last updated: 24 Feb '12, 08:24

Copyright © 2005-2012 Splunk Inc. All rights reserved.