Splunk Search

How to get the sourcetype count by each source top 10 events counts

harishsplunk7
Explorer

I need to get the  sourcetype count by each source top 10 events counts in splunk

Example : 

I have 3 sourcetype and sending data from different sources, 

sourcetype A - a,b,c,d,e

sourcetype B -a,b,c,d,e

sourcetype C -a,b,c,d,e

Now, I need to display top 10 event count by each source by sourcetype

0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| stats count by sourcetype source
| sort 0 sourcetype -count
| streamstats count as rank by sourcetype
| where rank <= 10

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| stats count by sourcetype source
| sort 0 sourcetype -count
| streamstats count as rank by sourcetype
| where rank <= 10

harishsplunk7
Explorer

Thank you so much!!!

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Can you elaborate what you are looking for?  Maybe illustrate what the end result looks like, and explain what each box means.

0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...