Hello,
I would like to create a search that select the top 10 events
Like this:
[Mon Sep 22 17:14:36 2014] [error] [client XXX] File does not exist: /var/www/html/home-store 1000 30
[Mon Sep 22 15:53:37 2014] [error] [client XXX] Bean "Hits_Bean_List.__isset" does not support attrib 500 20
Any suggestions? Any idea is welcome.
Thanks
First, if timestamp does not matter, you may want to extract a fields, say called raw, that has only the event. I'm assuming the pattern above are for all your events. Example props.conf
[Insert Name of your sourcetype]
EXTRACT-raw=^\[.*?\](?P<raw>.*)
Then, simply run the search:
sourcetype="Insert name of your sourcetype"|top raw limit=10
I'm not sure if this answers your question I don't know if all your events follow the pattern above. Nevertheless, the top command can get you there.
Sorry, I had two typos in there. Change that in props.conf to what is now listed in the answer.
You can use http://regex101.com/ to test a regex (remove the ?P in the test regex). BTW, you should put your props.conf in $SPLUNK_HOME/etc/apps/search/local/props.conf
Your search would be: sourcetype=splunk_web_service|top raw limit=10
This assumes that your source "/var/log/httpd/*-error_log" is indeed tied to this sourcetype.
Thank you for reply,
I tried to update the config file:
splubk/etc/apps/search/default/props.conf
[splunk_web_service]
EXTRACT-raw=^[.?](?
And tried to search through the browser
source="/var/log/httpd/*-error_log" | top raw limit=10
but no luck:
No results found.
I want to find the top 10 raw repeated in any log file such as Apache error log.
Can you help me?
Thanks