Splunk Search

Top Values of 2 fields

mcm10285
Communicator

Hi, I'm trying to create a search that would show the following data

Top unique field1 Top field2

E.g. (Username and command)

Get top unique Usernames and the corresponding top "command" executed by that "Username"

Username Command

user1 write

Hope someone can help, thanks.

Tags (2)
1 Solution

Ron_Naken
Splunk Employee
Splunk Employee

It sounds like you want a list of the top command performed by each user. This will work:

... | top limit=1 command by user

Also, if you only wanted the top 10 users responsible for the top commands, do it like this:

... | top limit=1 command by user | head 10

View solution in original post

lpolo
Motivator

I got accurate results if I use:

top limit=10 command,user

0 Karma

Ron_Naken
Splunk Employee
Splunk Employee

It sounds like you want a list of the top command performed by each user. This will work:

... | top limit=1 command by user

Also, if you only wanted the top 10 users responsible for the top commands, do it like this:

... | top limit=1 command by user | head 10

lpolo
Motivator

Ron,

I used your example but it seems that Splunk can only handle 6 digits precision using the top search command.

0 Karma

mcm10285
Communicator

Ron,

Thanks for this. However, I guess I was not really clear with the inquiry. What I was looking for was a form search containing 2 input fields and matching those 2 fields and showing it as an event.

I came up with a form search XML (could not paste everything) and it would seem to be ok. Would appreciate more inputs for improvement, thanks.



index=hlr|search USERID=$USERID$ COMMAND=$COMMAND$ ...

0 Karma

Ron_Naken
Splunk Employee
Splunk Employee

You can change the "limit" option to include more top commands per user. You can also substitute "rare" for "top", if you wanted to find the least used.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...