Splunk Search

How to get the top 10 URL's visited by count and then sort those 10 URL's by sum(bandwidth) in ascending order.

rsingh_splunk
Splunk Employee
Splunk Employee

So basically what i need is 3 columns which contains the top 10 visited URL's with count sorted by highest bandwidth used by them.
URL | COUNT | SUM(Bandwidth)

any help would be greatly appreciated..new to splunk.

0 Karma
1 Solution

sundareshr
Legend

Try this

index=weblogs [search index=weblogs | top 10 url | fields url ] | stats count sum(bandwidth) as sum by url

View solution in original post

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

Let's avoid subsearches as much as possible. Maybe this:

index=weblogs | fields url bandwidth | stats count sum(bandwidth) as bw by url | top 10 bw

You could also sort after the stats and do a | head 10 if that top is cutting out your fields.

0 Karma

rsingh_splunk
Splunk Employee
Splunk Employee

Thank Esix, but this search just shows the top 10 urls by bandwidth used, what i want is top 10 url's visited and then sort those 10 url's by bandwidth used.
any way to do it without using subsearches?

0 Karma

simon_lavigne
Path Finder

Using Esix's search change | top 10 bw to | top 10 bw url

0 Karma

sundareshr
Legend

Try this

index=weblogs [search index=weblogs | top 10 url | fields url ] | stats count sum(bandwidth) as sum by url
0 Karma

rsingh_splunk
Splunk Employee
Splunk Employee

Thanks a lot @sundareshr, works like a charm but the only problem is that i couldn't get the count field in my final result.
I tried adding it using fields but i get a blank column without values.

here is my search:
index=weblog [search index=weblog | top 10 url |fields url] |stats sum(bandwidth) by url | sort -sum(bandwidth) | fields url, sum(bandwidth),count

0 Karma

sundareshr
Legend

change your stats command to

....  |stats count sum(bandwidth) by url |

To @esix point, its is best to avoid subsearches. I should have thought of that. You can change you search to

index=weblog | stats count sum(bandwidth) as bandwidth | sort count | head 10
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...