https://community.splunk.com/t5/Splunk-Search/Daily-Weekly-Monthly-top-traffic-report/m-p/13595#M1302 <P>I've got weblogs going into splunk. We have a bunch of different domain names (extracted as http_domain) in the logs. Our traffic is variable, and I'd like to find out what the top 10 domains are for each period, ideally with the count of lines for those top 10 as well. </P> <P>the trivial query:</P> <P><CODE>nginx | timechart count by http_domain</CODE> </P> <P>provides what I want for a specified period. I'd like to be able to run this for every day, week, whatever and get the top 10 results for that period, not for the entire run time. </P> <P>Thanks! Oren</P> Sun, 16 May 2010 09:15:21 GMT Oren 2010-05-16T09:15:21Z https://community.splunk.com/t5/Splunk-Search/Daily-Weekly-Monthly-top-traffic-report/m-p/13595#M1302 <P>I've got weblogs going into splunk. We have a bunch of different domain names (extracted as http_domain) in the logs. Our traffic is variable, and I'd like to find out what the top 10 domains are for each period, ideally with the count of lines for those top 10 as well. </P> <P>the trivial query:</P> <P><CODE>nginx | timechart count by http_domain</CODE> </P> <P>provides what I want for a specified period. I'd like to be able to run this for every day, week, whatever and get the top 10 results for that period, not for the entire run time. </P> <P>Thanks! Oren</P> Sun, 16 May 2010 09:15:21 GMT https://community.splunk.com/t5/Splunk-Search/Daily-Weekly-Monthly-top-traffic-report/m-p/13595#M1302 Oren 2010-05-16T09:15:21Z https://community.splunk.com/t5/Splunk-Search/Daily-Weekly-Monthly-top-traffic-report/m-p/13596#M1303 <P>How about:</P> <PRE><CODE> nginx | bucket _time span=1d | top 10 http_domain by _time </CODE></PRE> Sun, 16 May 2010 13:56:44 GMT https://community.splunk.com/t5/Splunk-Search/Daily-Weekly-Monthly-top-traffic-report/m-p/13596#M1303 gkanapathy 2010-05-16T13:56:44Z