Daily/Weekly/Monthly top traffic report?

[Oren]

I've got weblogs going into splunk. We have a bunch of different domain names (extracted as http_domain) in the logs. Our traffic is variable, and I'd like to find out what the top 10 domains are for each period, ideally with the count of lines for those top 10 as well.

the trivial query:

nginx | timechart count by http_domain

provides what I want for a specified period. I'd like to be able to run this for every day, week, whatever and get the top 10 results for that period, not for the entire run time.

Thanks! Oren

[gkanapathy · Accepted solution]

How about:

 nginx | bucket _time span=1d | top 10 http_domain by _time