topic Re: Get the top n results when searched by count and span in Splunk Search

Get the top n results when searched by count and span

SaiDarur — Mon, 20 Nov 2023 15:05:56 GMT

Hi All,

I am trying to get the top n users who made calls to some APIs over a span of 5 minutes.

For example:
By the below query, I can see the chart which made calls for a period of time over a span of 5 minutes.

Query

timechart span=5min count(action) by applicationname

Now, I need to select the top n users (applicationname) which had high number of calls only for a span of 5 minutes.

In the below image, need the the users with sudden spikes.

Re: Get the top n results when searched by count and span

richgalloway — Mon, 20 Nov 2023 14:53:21 GMT

The timechart command has a limit option that will give you the top n results.

| timechart span=5min limit=5 count(action) by applicationname

Re: Get the top n results when searched by count and span

PickleRick — Mon, 20 Nov 2023 15:14:39 GMT

It's not that easy 😉

1. Often overlooked thing - timechart with span=something means just chopping time into span-sized slices. It does _not_ mean doing a sliding window aggregation. I suppose you can't do that other way than using streamstats.

2. limit=X with timechart gives you only X top results _overall_, not per each bin.

Re: Get the top n results when searched by count and span

SaiDarur — Mon, 20 Nov 2023 15:28:07 GMT

Thank you both. Is there any other way where I can achieve this?

Re: Get the top n results when searched by count and span

PickleRick — Mon, 20 Nov 2023 15:31:14 GMT

To get the count over a sliding window you'd need to do - as I mentioned - streamstats with time_window set to your 5 minutes. Then you can do a simple top command or something like that.

Re: Get the top n results when searched by count and span

SaiDarur — Mon, 20 Nov 2023 17:49:43 GMT

Thank you both. Is there any other approach to get this result? If so, please do help me on this.
Thanks