https://community.splunk.com/t5/Splunk-Search/Query-to-return-top-ten-users-and-the-applications-they-connect/m-p/174275#M50010 <P>My events contain users and applications to which they connect to. I want a query to return top 10 users and the applications which they connect to? Also Is it possible to display it in a chart ?<BR /> I want top 10 users and then I just need what applications each user is connected to. Im missing something. Any ideas?<BR /> Thanks in advance</P> Thu, 07 Aug 2014 10:24:34 GMT splunkn 2014-08-07T10:24:34Z https://community.splunk.com/t5/Splunk-Search/Query-to-return-top-ten-users-and-the-applications-they-connect/m-p/174275#M50010 <P>My events contain users and applications to which they connect to. I want a query to return top 10 users and the applications which they connect to? Also Is it possible to display it in a chart ?<BR /> I want top 10 users and then I just need what applications each user is connected to. Im missing something. Any ideas?<BR /> Thanks in advance</P> Thu, 07 Aug 2014 10:24:34 GMT https://community.splunk.com/t5/Splunk-Search/Query-to-return-top-ten-users-and-the-applications-they-connect/m-p/174275#M50010 splunkn 2014-08-07T10:24:34Z https://community.splunk.com/t5/Splunk-Search/Query-to-return-top-ten-users-and-the-applications-they-connect/m-p/174276#M50011 <P>Yes it is possible.</P> <P>Are you facing any issues? Have you tried writing the searches?</P> <P>You also need to post the log events for folks to help you</P> Thu, 07 Aug 2014 10:48:52 GMT https://community.splunk.com/t5/Splunk-Search/Query-to-return-top-ten-users-and-the-applications-they-connect/m-p/174276#M50011 strive 2014-08-07T10:48:52Z https://community.splunk.com/t5/Splunk-Search/Query-to-return-top-ten-users-and-the-applications-they-connect/m-p/174277#M50012 <P>Without knowing what your events look like, and not really understanding how you want the results presented, you could try one of the following - assuming the fields are called 'user' and 'application';</P> <PRE><CODE>your_search | top user by application </CODE></PRE> <P>which will give your the top 10 users for each application. Or - if there is more of a one-to-one relationship between users and applications, you could concatenate the two for presentation purposes;</P> <PRE><CODE>your_search | eval user_app = user . application | top user_app </CODE></PRE> <P>/K</P> Thu, 07 Aug 2014 11:39:28 GMT https://community.splunk.com/t5/Splunk-Search/Query-to-return-top-ten-users-and-the-applications-they-connect/m-p/174277#M50012 kristian_kolb 2014-08-07T11:39:28Z https://community.splunk.com/t5/Splunk-Search/Query-to-return-top-ten-users-and-the-applications-they-connect/m-p/174278#M50013 <P>Im having users who are logged on to various applications like below. <BR /> User1 logged to app1<BR /> User1 logged to app2<BR /> USer2 logged to app1<BR /> User3 logged to app2 etc...<BR /> I want to take top 10 users and need to append what are the applications they logged in as below.<BR /> User Application Count<BR /> User1 app1 10<BR /> app2 5<BR /> User2 app1 4<BR /><BR /> User3 app2 4 <BR /> I tried with the search as index=* sourcetype=* "login succeeded" [search index=* sourcetype=* "login succeeded" | top limit=10 user | fields user] | fields user,application_name | stats count by user,appplication_name.</P> Mon, 28 Sep 2020 17:17:04 GMT https://community.splunk.com/t5/Splunk-Search/Query-to-return-top-ten-users-and-the-applications-they-connect/m-p/174278#M50013 splunkn 2020-09-28T17:17:04Z