Splunk Search

How to edit my timechart search to find the top 5 users who get disconnected from our application on a monthly basis?

mishradb
New Member

I would like to view the top 5 users who get disconnected from our application on a monthly basis. I ran the search below from Jan 15 to Jun 15:

index=client sourcetype=client-logs "channel connect failed" channel=* date_month!=NULL  | timechart count by guid where max in top5.

However, if i run the search above for just 1 month, the top 5 users returned is different from what i get when i run it for 6 months.
Considering the fact that, the top 5 users could vary on a monthly basis, what is the best way of achieving this?

Tags (3)
0 Karma

woodcock
Esteemed Legend

Beware the use of the date_* fields, they are not always correct (ask me why if you really would like the gory details). Try this:

index=client sourcetype=client-logs "channel connect failed" channel=* | timechart span=1m count BY guid | top 5 count BY guid,_time

aweitzman
Motivator

You should be able to just use top for this:

... | top 5 guid by date_month
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...