Splunk Enterprise

top 1000 by appiD



From a set of log events I need to get the daily Top 1000 calls by each appId and clientId.
How can I do this in a single query without using the append command?

log events:

timestamp call=123 client=a appId=1
timestamp call=123 client=a appId=1
timestamp call=123  client=a appId=1
timestamp call=12 client=a appId=1
timestamp call=123 client=b appId=1
timestamp call=123 client=b appId=2
Nth event

So the result set based on these logs is :

day | call | client | appId | count
07/14/2020 | 123 | a | 1 | 3
07/14/2020 | 12 | a | 1 | 2
07/14/2020 | 123 | b | 1 | 1
07/14/2020 | 123 | b | 2 | 1 

The idea is to get the Top 1000 calls by each tuple of client : appId.
Thanks for your help.

Labels (1)
Tags (1)
0 Karma

Ultra Champion
index=<index name> sourcetype=<your sourcetype>
| bin _time span=1d
| stats count by _time call client appId
| eval day=strftime(_time,"%m/%d/%Y")
| table day call client appId count
| sort 1000 - count

how about this?


Thanks for the query, It does not provide the intended result of Top 1000 calls for each tuple of client and appId.  I have been able to get the intended result by using the append command. The problem is that the query is too slow. I asked the question to find out if there is a trick that I am not aware of.... without using the append command. 

0 Karma
Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! &#x1f308; In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...