Splunk Search

How to get top 10 data source from Splunk ?

corecomputetool
New Member

is this command is correct ?

** | chart count by sourcetype | sort count desc*

Tags (1)
0 Karma
1 Solution

Shan
Builder

@corecomputetools,

Please try below query ..

 index=* | chart count by sourcetype | sort limit=10 -count

index=* | chart count by sourcetype | sort -count | head 10

Thanks..

View solution in original post

0 Karma

DavidHourani
Super Champion

Hi @corecomputetools,

Use the following for getting the list of top indexes :

|tstats count where index=* by index | sort limit=10 -count

For index and sourcetype:

|tstats count where index=* by index,sourcetype | sort limit=10 count

PS: Avoid using index=* as it will run very slow and consume resources for nothing.

Cheers,
David

0 Karma

corecomputetool
New Member

Thanks for the update.

0 Karma

DavidHourani
Super Champion

Most welcome, use the tstats when trying to access metadata and display a count by index, host or even sourcetype. Let me know if you're getting faster results with this search 🙂

0 Karma

Shan
Builder

@corecomputetools,

Please try below query ..

 index=* | chart count by sourcetype | sort limit=10 -count

index=* | chart count by sourcetype | sort -count | head 10

Thanks..

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@corecomputetools

Have you tried limit?

| chart count by sourcetype | sort limit=10 -count

0 Karma

corecomputetool
New Member

Thank you !!

0 Karma

corecomputetool
New Member

no, this limit=1denotes of ?

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

limit=10 display top 10 values.

index=_internal | chart count by sourcetype | sort limit=10 -count
0 Karma

corecomputetool
New Member

Hi Kamlesh,

Thank you for the immediate response.

It worked with the above command. :):)

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@corecomputetools

Glad to help you. Please upvote any comments which help you.

Happy Splunking

0 Karma
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...