Splunk Search

Daily/Weekly/Monthly top traffic report?

Oren
Explorer

I've got weblogs going into splunk. We have a bunch of different domain names (extracted as http_domain) in the logs. Our traffic is variable, and I'd like to find out what the top 10 domains are for each period, ideally with the count of lines for those top 10 as well.

the trivial query:

nginx | timechart count by http_domain

provides what I want for a specified period. I'd like to be able to run this for every day, week, whatever and get the top 10 results for that period, not for the entire run time.

Thanks! Oren

Tags (1)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

How about:

 nginx | bucket _time span=1d | top 10 http_domain by _time

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

How about:

 nginx | bucket _time span=1d | top 10 http_domain by _time
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...