I'm currently running searches to track the behavior of users on a particular mobile application. The first step in this is identifying which users to track, for which I run a query over a couple of weeks that returns an immense volume of logs and extract a userID field. When I select the userID field, Splunk shows me the top ten most prevalent userIDs, i.e. my most active users. This system has worked fine when I needed the highest activity users, but now I need low activity users as well and I'm wondering if there is any way to view the top 100 or all the userID's that are organized into the userID field.
You can't sort on a field that doesn't exist yet. Try replacing
| sort count | head 10 | stats count by userId
with
| stats count by userId | sort count
| stats count by userID | sort - count
I got this to work for some sample queries, but can't get it to work for the actual query I need to run. What I've tried is:
index!="x" instance!="cs" logName="/mobile/direct/" logRecordTypeU=1 NOT logName="/mobile/direct/2.0.adobeair/" |fields logName, _time, organizationId, userId | rex field=logName "/mobile/direct/2..0.(?
I'm pretty sure this is just a syntax error, but I don't know what exactly the error is.