topic Re: Syntax for 'top x application by usage per source ip' in Splunk Search

Syntax for 'top x application by usage per source ip'

ahmadsaadwarrai — Wed, 30 Sep 2020 00:46:02 GMT

I have raw search:

How do I add top parameters, saying top x applications based on usage per source IP.

Re: Syntax for 'top x application by usage per source ip'

nabeel652 — Fri, 31 May 2019 02:49:56 GMT

<your search> | top 10 application by sourceIP

Re: Syntax for 'top x application by usage per source ip'

ahmadsaadwarrai — Wed, 30 Sep 2020 00:44:22 GMT

I am able to do it using below search:

| ess eaddr=172.20.8.60:9200 index=nuage_dpi_flowstats-* tsfield=timestamp query="EnterpriseName=Lismore Diocese"
| eval _time=strftime(_time/1000, "%Y-%m-%d %H:%M:%S")
| stats sum(TotalMB) as "Total(MB)" by DstIp, L7ClassEnhanced, DestinationNSG
| sort DstIp -"Total(MB)"
| eval counter = 1
| streamstats sum(counter) as seqNo by DstIp
| where seqNo < 5
| fields - counter seqNo
| search NOT DestinationNSG=ULT1_NSGX1

Re: Syntax for 'top x application by usage per source ip'

darshildave — Fri, 31 May 2019 08:32:44 GMT

| stats values('Total(MB)') by source_ip | sort 0 - 'Total(MB)' | head limit=x

Here 'Total(MB)' is the usage and limit returns first x records from results.