How do you use the timechart command to retrieve top IP by span window with top value in this window?

[evkuzin]

I try to get from iis logs top source IP by requests with the number of requests in every 5 seconds.
If I just try to find top IP in span - it works well. f.e.:

• sourcetype="ms:iis:auto" cs_host="www.example.com"
  | timechart mode(c_ip) span=5sec

also search to fint count is works well:

sourcetype="ms:iis:auto" cs_host="www.example.com"

| timechart max(c_ip) span=5sec

But if I try to use both - search output nothing. why?

sourcetype="ms:iis:auto" cs_host="www.example.com"

| timechart mode(c_ip), max(c_ip) span=5sec

[jlelli · Accepted solution]

Ok, let's talk about mode(): is gives you the most frequent field however it does not gives you the count used to extract that values. To obtain that value is a bit of a pain.

Additionally your search

sourcetype="ms:iis:auto" cs_host="www.example.com" | timechart max(c_ip) span=5sec
Leaves me a bit puzzled because it should give you the max value of the C_ip field; it does not give you the count. Are you sure is it working correctly?

The best solution i can advise is to use this method (https://answers.splunk.com/answers/99221/counting-how-often-the-mode-value-occurs-in-a-result-set.ht...) to extract the count of the mode(); applied to your fields it should become:

sourcetype="ms:iis:auto" cs_host="www.example.com"
| bin _time span=5s 
| eventstats mode(C_ip) as mostfrequent by _time `
| eval isMode=if(C_ip=mostfrequent,1,0) 
| timechart span=5s mode(C_ip) as mode, sum(isMode) as hits

Hope this answers your question!

[evkuzin]

thx a lot!