Splunk Search

How to edit my timechart search to find the top 5 users who get disconnected from our application on a monthly basis?

mishradb
New Member

I would like to view the top 5 users who get disconnected from our application on a monthly basis. I ran the search below from Jan 15 to Jun 15:

index=client sourcetype=client-logs "channel connect failed" channel=* date_month!=NULL  | timechart count by guid where max in top5.

However, if i run the search above for just 1 month, the top 5 users returned is different from what i get when i run it for 6 months.
Considering the fact that, the top 5 users could vary on a monthly basis, what is the best way of achieving this?

Tags (3)
0 Karma

woodcock
Esteemed Legend

Beware the use of the date_* fields, they are not always correct (ask me why if you really would like the gory details). Try this:

index=client sourcetype=client-logs "channel connect failed" channel=* | timechart span=1m count BY guid | top 5 count BY guid,_time

aweitzman
Motivator

You should be able to just use top for this:

... | top 5 guid by date_month
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...