Hi, I am new to Splunk, I would like to create a command where it can find top 10 events happened within 24 hours. index="name" events =*| top 10 User | stats count(User) as Count by User | sort - Count | head 10
Do you like top 10 events per user?
index="name" events =* | stats count by host events | sort host -count | streamstats count as counter by host | where counter<11 | fields - counter
What is the question? | top 10 User will return ten most populous users and sort in reverse numeric order. You don't need to count the output. Are you not getting that with just | top 10 User?
