Splunk Search

Daily/Weekly/Monthly top traffic report?

Oren
Explorer

I've got weblogs going into splunk. We have a bunch of different domain names (extracted as http_domain) in the logs. Our traffic is variable, and I'd like to find out what the top 10 domains are for each period, ideally with the count of lines for those top 10 as well.

the trivial query:

nginx | timechart count by http_domain

provides what I want for a specified period. I'd like to be able to run this for every day, week, whatever and get the top 10 results for that period, not for the entire run time.

Thanks! Oren

Tags (1)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

How about:

 nginx | bucket _time span=1d | top 10 http_domain by _time

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

How about:

 nginx | bucket _time span=1d | top 10 http_domain by _time
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...