Getting Data In

Need help to filter the top five sources

mike7860
Explorer

I need to find the top five sources. As Splunk displays as a default the top ten commonly used or found values. I need to narrow it down to find the top 5 source files. I have tried using the following search criteria but nothing displays:
index=summary_volume report=volume_source | eval _time=info_max_time | timechart span=1m latest(VOL_MB) by series | top limit=5 source

Tags (1)
0 Karma

mike7860
Explorer

it doesn't display any results.

0 Karma

lguinn2
Legend

How do you define "top 5"? Is it the five sources with the greatest total volume over the whole time period? If so, this should do it:

index=summary_volume report=volume_source | eval _time=info_max_time 
| timechart span=1m limit=5 latest(VOL_MB) by series

Although I do wonder about what is in your "summary_volume" index. If you inserted data into the summary index using an sitimechart command, then there should be a field called search_name, not report. And you should also not need to do an eval to create the _time field.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>