https://community.splunk.com/t5/Splunk-Search/searching-TOP-query/m-p/73385#M18372 <P>Hi Folks, First time using splunk, i've managed to get my draytek router chucking the logs to splunk.</P> <P>id like to perform a search so i can create a dashboard panel that shows me the TOP DNS queries, im not sure of the best way to do this, perhaps some one can point me in the right direction and provide me some code if needs be.</P> <P>I would be really very qreatful for any help i can get.</P> <P>Below is a log extract showing a dns lookup - raw data from the draytek</P> <PRE><CODE>Jun 24 16:22:06 192.168.y.x Jun 24 16:20:51 Router: Local User (MAC=AA-BB-CC-DD-EE-FF): 192.168.y.x DNS -&gt; 212.159.6.10 inquire orcart.facebook.com </CODE></PRE> Mon, 24 Jun 2013 15:40:31 GMT rootadmin 2013-06-24T15:40:31Z https://community.splunk.com/t5/Splunk-Search/searching-TOP-query/m-p/73385#M18372 <P>Hi Folks, First time using splunk, i've managed to get my draytek router chucking the logs to splunk.</P> <P>id like to perform a search so i can create a dashboard panel that shows me the TOP DNS queries, im not sure of the best way to do this, perhaps some one can point me in the right direction and provide me some code if needs be.</P> <P>I would be really very qreatful for any help i can get.</P> <P>Below is a log extract showing a dns lookup - raw data from the draytek</P> <PRE><CODE>Jun 24 16:22:06 192.168.y.x Jun 24 16:20:51 Router: Local User (MAC=AA-BB-CC-DD-EE-FF): 192.168.y.x DNS -&gt; 212.159.6.10 inquire orcart.facebook.com </CODE></PRE> Mon, 24 Jun 2013 15:40:31 GMT https://community.splunk.com/t5/Splunk-Search/searching-TOP-query/m-p/73385#M18372 rootadmin 2013-06-24T15:40:31Z https://community.splunk.com/t5/Splunk-Search/searching-TOP-query/m-p/73386#M18373 <P>You will firstly need to extract the fields you require..</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/5.0.3/Knowledge/Addfieldsatsearchtime">http://docs.splunk.com/Documentation/Splunk/5.0.3/Knowledge/Addfieldsatsearchtime</A></P> <P>You will then need to pipe your search to the top command on that field.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Top">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Top</A></P> Mon, 24 Jun 2013 16:09:04 GMT https://community.splunk.com/t5/Splunk-Search/searching-TOP-query/m-p/73386#M18373 MHibbin 2013-06-24T16:09:04Z