Splunk Search

Viewing beyond the top 10 results within an extracted field

ebenioff
New Member

I'm currently running searches to track the behavior of users on a particular mobile application. The first step in this is identifying which users to track, for which I run a query over a couple of weeks that returns an immense volume of logs and extract a userID field. When I select the userID field, Splunk shows me the top ten most prevalent userIDs, i.e. my most active users. This system has worked fine when I needed the highest activity users, but now I need low activity users as well and I'm wondering if there is any way to view the top 100 or all the userID's that are organized into the userID field.

Tags (2)
0 Karma

FunPolice
Path Finder

You can't sort on a field that doesn't exist yet. Try replacing

| sort count | head 10 | stats count by userId 

with

 | stats count by userId | sort count
0 Karma

twinspop
Influencer
| stats count by userID | sort - count
0 Karma

ebenioff
New Member

I got this to work for some sample queries, but can't get it to work for the actual query I need to run. What I've tried is:

index!="x" instance!="cs" logName="/mobile/direct/" logRecordTypeU=1 NOT logName="/mobile/direct/2.0.adobeair/" |fields logName, _time, organizationId, userId | rex field=logName "/mobile/direct/2..0.(?[^/])/.*" | where not isnull(device) | timechart span=2w dc(userId) as uniqueUsers by device | sort count | head 10 | stats count by userId

I'm pretty sure this is just a syntax error, but I don't know what exactly the error is.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...