Splunk Search

timechart count by source, top talker by span

dwengi
Engager

Hi Everyone,

I'm trying to craft a timechart that shows the top "hits per source" and then only display the top source per the 5 minute span.

something like this "sourcetype=firewall | timechart span=5m count by src limit=1"

but this will only display 1 source, not the 1 top source per slice of time.

Thoughts?

Tags (1)
0 Karma
1 Solution

acdevlin
Communicator

You might want to try the Bucket command instead of timechart; it will group your events into sets based upon a span you define. To find the single source you're interested in, I would then suggest the Top command and set its limit to 1.

The overall query I tried looked something like this:

... | bucket _time span=5m | top src by _time limit=1

I can't guarantee it's the single most efficient method of solving the problem, but I'm pretty sure it will return the results you are looking for.

Does this help answer your question?

View solution in original post

acdevlin
Communicator

You might want to try the Bucket command instead of timechart; it will group your events into sets based upon a span you define. To find the single source you're interested in, I would then suggest the Top command and set its limit to 1.

The overall query I tried looked something like this:

... | bucket _time span=5m | top src by _time limit=1

I can't guarantee it's the single most efficient method of solving the problem, but I'm pretty sure it will return the results you are looking for.

Does this help answer your question?

dwengi
Engager

That worked beautifully, thank you!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...