Hi Everyone,
I'm trying to craft a timechart that shows the top "hits per source" and then only display the top source per the 5 minute span.
something like this "sourcetype=firewall | timechart span=5m count by src limit=1"
but this will only display 1 source, not the 1 top source per slice of time.
Thoughts?
You might want to try the Bucket command instead of timechart; it will group your events into sets based upon a span you define. To find the single source you're interested in, I would then suggest the Top command and set its limit to 1.
The overall query I tried looked something like this:
... | bucket _time span=5m | top src by _time limit=1
I can't guarantee it's the single most efficient method of solving the problem, but I'm pretty sure it will return the results you are looking for.
Does this help answer your question?
You might want to try the Bucket command instead of timechart; it will group your events into sets based upon a span you define. To find the single source you're interested in, I would then suggest the Top command and set its limit to 1.
The overall query I tried looked something like this:
... | bucket _time span=5m | top src by _time limit=1
I can't guarantee it's the single most efficient method of solving the problem, but I'm pretty sure it will return the results you are looking for.
Does this help answer your question?
That worked beautifully, thank you!