topic How to get top 2 MB users per website? in Splunk Search

How to get top 2 MB users per website?

jrodriguezap — Thu, 31 Jul 2014 23:45:40 GMT

Hi!
That maybe someone has been through this. I have the following table as a result of search:

**website**      **user**        **MB**
  google.com      jperez          125.71
  facebook.com    smartinez       116.90
  facebook.com    jperez          92.45
  facebook.com    asevalloz       71.09
  twitter.com     jperez          63.85
  google.com      marevalo        43.85
  google.com      arios           23.85
  twitter.com     lgutierrez      13.85
  facebook.com    asevalloz       11.09

And what I would like is to get the 2 users that generate more MB per website.

**website**      **user**        **MB**
  google.com      jperez          125.71
  google.com      marevalo        43.85
  facebook.com    smartinez       116.90
  facebook.com    jperez          92.45
  twitter.com     jperez          63.85
  twitter.com     lgutierrez      13.85

I tried with: search...| top 3 MB website by user
But it turned out, I would appreciate it much
:)

regards

Re: How to get top 2 MB users per website?

lguinn2 — Fri, 01 Aug 2014 00:29:27 GMT

Try this - let me assume that your events contain the following fields:

user website MB

and that each event represents a TCP hit or something similar.

yoursearchhere
| stats sum(MB) as MB by website user
| sort website -MB
| eval counter = 1
| streamstats sum(counter) as seqNo by website
| where seqNo < 3
| fields - counter seqNo

The streamstats command generates a sequence number, which resets for each website. Then the where eliminates all but the top 2 users for each website.

Re: How to get top 2 MB users per website?

jrodriguezap — Fri, 01 Aug 2014 02:11:11 GMT

Excellent lguinn!
It was just the logic I had in mind but did not know how to make, I really appreciate it!
:)