Using top to show common field values

A very common question that may often arise is: "Which values are the most common?" When looking for errors, you are probably interested in figuring out what piece of code has the most errors. The top command provides a very simple way to answer this question.

Let's step through a few examples.

First, run a search for errors:

sourcetype="tm1" error

The preceding example searches for the word error in all source types starting with the character string "tm1*" (with the asterisk being the wildcard character).

In my data, it finds events containing the word error, a sample of which is listed in the following screenshot:

Since I happen to know that the data I am searching is made up of application log files generated throughout the year, it might be interesting to see the month that had the most errors logged. To do that, we can simply add | top date_month to our search, like so:

sourcetype="tm1*" error | top date_month 

The results are transformed by top into a table like the following one:

From these results, we see that october is logging significantly more errors than any other month. We should probably take a closer look at the activity that occurred during that month.

Next, perhaps we would like to determine whether there is a particular day of the week when these errors are happening. Adding another field name to the end of the command instructs top to slice the data again. For example, let's add date_wday to the end of our previous query, like so:

sourcetype="tm1*" error | top date_month date_wday

The results might look like the following screenshot:

In these results, we see that wednesday is logging the most errors from the month of october. If we simply want to see the distribution of errors by date_wday, we specify only the user field, like so:

sourcetype=tm1* error | top date_wday