I need to get the sourcetype count by each source top 10 events counts in splunk
Example :
I have 3 sourcetype and sending data from different sources,
sourcetype A - a,b,c,d,e
sourcetype B -a,b,c,d,e
sourcetype C -a,b,c,d,e
Now, I need to display top 10 event count by each source by sourcetype
| stats count by sourcetype source
| sort 0 sourcetype -count
| streamstats count as rank by sourcetype
| where rank <= 10
| stats count by sourcetype source
| sort 0 sourcetype -count
| streamstats count as rank by sourcetype
| where rank <= 10
Thank you so much!!!
Can you elaborate what you are looking for? Maybe illustrate what the end result looks like, and explain what each box means.