I've got weblogs going into splunk. We have a bunch of different domain names (extracted as http_domain) in the logs. Our traffic is variable, and I'd like to find out what the top 10 domains are for each period, ideally with the count of lines for those top 10 as well.
the trivial query:
nginx | timechart count by http_domain
provides what I want for a specified period. I'd like to be able to run this for every day, week, whatever and get the top 10 results for that period, not for the entire run time.
Thanks!
Oren
