Splunk Search

How to get the sourcetype count by each source top 10 events counts

harishsplunk7
Explorer

I need to get the  sourcetype count by each source top 10 events counts in splunk

Example : 

I have 3 sourcetype and sending data from different sources, 

sourcetype A - a,b,c,d,e

sourcetype B -a,b,c,d,e

sourcetype C -a,b,c,d,e

Now, I need to display top 10 event count by each source by sourcetype

0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| stats count by sourcetype source
| sort 0 sourcetype -count
| streamstats count as rank by sourcetype
| where rank <= 10

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| stats count by sourcetype source
| sort 0 sourcetype -count
| streamstats count as rank by sourcetype
| where rank <= 10

harishsplunk7
Explorer

Thank you so much!!!

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Can you elaborate what you are looking for?  Maybe illustrate what the end result looks like, and explain what each box means.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI! Discover how Splunk’s agentic AI ...

[Puzzles] Solve, Learn, Repeat: Dereferencing XML to Fixed-length events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...