topic Re: Need to identify the top 50 groups in Splunk Search

Need to identify the top 50 groups

kteng2024 — Mon, 24 Jul 2017 21:56:46 GMT

index=abc source=license_usage.log type=usage | rex field=h "(ab2)(?P\w+[^\d+])" |search Group=kb01m OR Group=kb02r  | eval GB = b/1024/1024  | rename s AS source | stats sum(GB) AS "MB consumed" by Group

Above is the query ,but we have different groups like kb02m,kb02r,kb03m,kb03r,kb04m,kb04r......kb500m . How can i modify my query to find which group is consuming more MB . i would like have output of top 50 contributing group names along with MB they consumed.

Re: Need to identify the top 50 groups

woodcock — Mon, 24 Jul 2017 22:12:14 GMT

Like this:

index=abc source=license_usage.log type=usage
| rex field=h "(ab2)(?<Group>\w+[^\d+])"
| regex Group="YourRegExForGroupsToConsiderHere"
| top limit=50 useother=f Group BY b

Re: Need to identify the top 50 groups

kteng2024 — Tue, 25 Jul 2017 02:52:56 GMT

thanks for the reply. But i am trying to make the group name dynamic because it is difficult to mention all the 500 groups . something like | Group=kb(\d)m OR Group=kb(\d)r

and it should list the top 50 groups .

Re: Need to identify the top 50 groups

cmerriman — Tue, 25 Jul 2017 11:30:37 GMT

 index=abc source=license_usage.log type=usage | rex field=h "(ab2)(?P\w+[^\d+])" |search Group=kb01m OR Group=kb02r  | eval GB = b/1024/1024  | rename s AS source | stats sum(GB) AS "MB consumed" by Group|sort 0 Group - "MB consumed" |streamstats count by Group|search count<=50|fields - count

something like this, maybe?

Re: Need to identify the top 50 groups

woodcock — Tue, 25 Jul 2017 15:01:44 GMT

I have updated my answer to include all requirements.