Using top to show common field values

A very common question that may often arise is: "Which values are the most common?" When looking for errors, you are probably interested in figuring out what piece of code has the most errors. The top command provides a very simple way to answer this question.

Let's step through a few examples.

First, run a search for errors:

sourcetype="tm1" error

The preceding example searches for the word error in all source types starting with the character string "tm1*" (with the asterisk being the wildcard character).

In my data, it finds events containing the word error, a sample of which is listed in the following screenshot:

Since I happen to know that the data I am searching is made up of application log files generated throughout the year, it might be interesting to see the month that had the most errors logged. To do that, we can simply add | top date_month to our search, like so:

sourcetype="tm1*" error | top date_month 

The results are transformed by top into a...