Splunk Search

Top 5 events for every month

emamedov
Explorer

I'm currently using the following log statement:

Jun-28 12:00:28 | INFO| [Controller:116] Downloading file content: fileName:  [Way Too Easy.pdf]

The intent is to generate a result that lists the top 5 downloads for every month and the percentage of downloads compared to every other event in that month. It would look something along the lines of:

alt text

Using the the following search string gets me close to it, but not quite.

eventtype="document-downloads" | eval Month=strftime(_time,"%m/%Y") | top limit=5 fileName by Month
0 Karma
1 Solution

ryanoconnor
Builder

See if the following gets you what you need:

 eventtype="document-downloads" | top limit=5 fileName by date_month | eventstats sum(count) as sum by date_month | eval percent=count/sum | table date_month fileName count percent

I tested this trying to do the same thing you did, except with the top 5 Windows Event Logs for given months. See the following search.

index=wineventlog| top limit=5 EventCode by date_month | eventstats sum(count) as sum by date_month | eval percent=count/sum | table date_month EventCode count percent

View solution in original post

ryanoconnor
Builder

See if the following gets you what you need:

 eventtype="document-downloads" | top limit=5 fileName by date_month | eventstats sum(count) as sum by date_month | eval percent=count/sum | table date_month fileName count percent

I tested this trying to do the same thing you did, except with the top 5 Windows Event Logs for given months. See the following search.

index=wineventlog| top limit=5 EventCode by date_month | eventstats sum(count) as sum by date_month | eval percent=count/sum | table date_month EventCode count percent

emamedov
Explorer

It was close, this is what I ended up with:

eventtype="document-downloads" | eval Month=strftime(_time,"%m/%Y") 
| top limit=10 fileName by Month 
| stats list(*) as * by Month 
| table Month fileName count percent
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...