Splunk Search

How to search for top 10 with stats list and count?

jwalzerpitt
Influencer

I have the following search that looks for a count of blocked domains per IP:

index=indexname
|stats count by domain,src_ip
|sort -count 
|stats list(domain) as Domain, list(count) as count by src_ip

How would I limit the results to the top 10 IPs and still retain the count of blocked domains per IP? I've tried limit and head commands, but it nullifies the count of blocked domains per IP format.

Thx

0 Karma
1 Solution

jwalzerpitt
Influencer

I think I figured it out after some fiddling. My query now looks like this:

index=indexname
|stats count by domain,src_ip
|sort -count
|stats list(domain) as Domain, list(count) as count, sum(count) as total by src_ip
|sort -total | head 10
|fields - total

which retains the format of the count by domain per source IP and only shows the top 10

View solution in original post

jwalzerpitt
Influencer

I think I figured it out after some fiddling. My query now looks like this:

index=indexname
|stats count by domain,src_ip
|sort -count
|stats list(domain) as Domain, list(count) as count, sum(count) as total by src_ip
|sort -total | head 10
|fields - total

which retains the format of the count by domain per source IP and only shows the top 10

ahmadsaadwarrai
Explorer

Thanks for this, if i want to see top 10 and all others in others? what will be the search? Can you please help?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try like this

index=indexname
 |stats count by domain,src_ip
 |sort -count 
 | streamstats count as rank by src_ip | where rank<=10 
 |stats list(domain) as Domain, list(count) as count by src_ip

Update

If you're looking for top 10 src_ip, then try this

index=indexname
| stats count by domain,src_ip
|sort -count 
|stats list(domain) as Domain, list(count) as count sum(count) as total by src_ip 
| sort -total | head 10

jwalzerpitt
Influencer

Thx for the modified search - retains the format of count of blocked domains per IP, but getting the full list of source IPs (src_ip) and not just the top 10.

0 Karma

tkwaller
Builder

Hello

Have you tried something like:

| top 10 src_ip

For example:

index=indexname
|stats count by domain,src_ip
|sort -count 
|stats list(domain) as Domain, list(count) as count by src_ip
| top 10 src_ip
0 Karma

jwalzerpitt
Influencer

I have, but the count for the top 10 hosts all equal 1.

Doing |top 10 Domain by src_ip provides the same output of the count equaling 1.

Thx

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...