I'm trying to run a query to figure out the top 10 src_ip's along with their top 10 urls visited. When I try the below query it's giving me every src_ip instead of just the top 10.
Any suggestions on how to limit the search for just the top 10 src_ip by top 10 url?
I've been running something like this:
index=firewall | stats count by src_ip, url
| sort 0 src_ip -count
| streamstats count as standings by src_ip
| where standings < 11
| eventstats sum(count) as total by category
| sort 0 -total src_ip -count
index=firewall
| stats count by src_ip, url
| sort 0 src_ip -count
| streamstats count as standings by src_ip
| where standings < 11
| eventstats sum(count) as total by src_ip
| sort 0 -total src_ip -count
| streamstats count(eval(standings=1)) as rank
| where rank < 11
@jhamot23 Did you know there's a top command? (it defaults to top 10, but this is configurable if you want)
See if this gets you in the neighborhood:
index=firewall
| top src_ip BY url
Appreciate the insights. Yes I just started playing around with the top command, and this did help get me in the neighborhood but was looking for a more cleaner list of just top 10 src_ips by top 10 urls visited. Looks like the suggestion below got me the list I was looking for. Thank you!
index=firewall
| stats count by src_ip, url
| sort 0 src_ip -count
| streamstats count as standings by src_ip
| where standings < 11
| eventstats sum(count) as total by src_ip
| sort 0 -total src_ip -count
| streamstats count(eval(standings=1)) as rank
| where rank < 11
This is what I was looking for! Thank you!