event count, per user, per hour

[tmarlette]

So i'm attempting to count a specific event type, per user, per hour. I only want the tope ten users, and I thought the 'top' command would do it, but I'm hitting a snag. The top command doesn't output any data at all.
I'm looking for this data to output in a table format with the fields time,user,count.

I attempted to use the following search query:

host=< myhost > eventtype=< my event type > | timechart span=1h count by user useother=false

Thank you!!

[okrabbe_splunk]

I think the issue is the output format of the table using time chart. If you manually bucket I think you will get a better result.

Try this:

host=< myhost > eventtype=< my event type > | bucket _time span=1h | stats count by _time,user | sort - count | head

[okrabbe_splunk]

Yeah you could do a subsearch and use that on the initial search. Something like below but you may need to play with it a bit.

host=< myhost > eventtype=< my event type > [ search host=< myhost > eventtype=< my event type > | top user | table user] | bucket _time span=1h | stats count by _time,user | sort - count | head

http://docs.splunk.com/Documentation/Storm/Storm/User/Useasubsearch

[tmarlette]

bucketing is exactly what I was looking for as far as the count for the time span! Thank you!

This gives the most recent offenders/instances, though I am looking for information on only the top ten offenders.

It's almost like I would need to run a search first to find the top ten offenders, then break out each user into a '_time" bucket and show their stats per hour individually? I'm guessing here 😃

[kml_uvce]

try this...

host=< myhost > eventtype=< my event type > | timechart span=1h limit=10 useother=f count by user

[tmarlette]

Almost! The result set I get now is the ten (limit=10) most recent offenders.

I thought the 'top' command was the way to go, but I can't seem to get the search to roll it's results to the top command and have it output the data.

[tmarlette]

It looks like I'm getting the latest 20 users, which are not the top offenders I am looking for.

[Ayn]

So, what was the result of the query you attempted?