Splunk Search

How to search the most frequently indexed lines in Splunk?

raghavarora12
New Member

Hi,

I would like to know how can we get top 10 or 20 lines which get indexed in Splunk from our log files.
This is to to get those lines and tune them so that they do not consume most part of Splunk data indexing and reduce the usage so as to give way to other lines/data.

In other words, to get the set of lines which get printed very often in Splunk and consume maximum size of indexed data.

Early response will be appreciated.

0 Karma

hartfoml
Motivator

I think you are asking about what logs generate the most traffic in splunk

you can use the punctuation field to find similer logs from different systems like this * | top punct

Be sure to use this for only a short time interval (5 or 15 minutes) as this could be a very intensive dense search

0 Karma

somesoni2
SplunkTrust
SplunkTrust
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...