A very common question that may often arise is, "What values are most common?" When looking for errors, you are probably interested in figuring out what piece of code has the most errors. The top command provides a very simple way to answer this question.

Let's step through a few examples.

First, run a search for errors:

sourcetype="tm1*" error

The preceding example searches for the word error in all sourcetypes starting with the character string "tm1*" (with the asterisk being the wildcard character).

In my data, we find events containing the word error, a sample of which is listed in the following screenshot:

Since I happen to know that the data I am searching is made up of application log files generated throughout the year, it might be interesting to see the month that had the most errors logged. To do that, we can simply add | top date_month to our search, like so:

sourcetype="tm1*" error | top date_month

The results are transformed by top into a table...