Splunk Search

How to get top 10 data source from Splunk ?

corecomputetool
New Member

is this command is correct ?

** | chart count by sourcetype | sort count desc*

Tags (1)
0 Karma
1 Solution

Shan
Builder

@corecomputetools,

Please try below query ..

 index=* | chart count by sourcetype | sort limit=10 -count

index=* | chart count by sourcetype | sort -count | head 10

Thanks..

View solution in original post

0 Karma

DavidHourani
Super Champion

Hi @corecomputetools,

Use the following for getting the list of top indexes :

|tstats count where index=* by index | sort limit=10 -count

For index and sourcetype:

|tstats count where index=* by index,sourcetype | sort limit=10 count

PS: Avoid using index=* as it will run very slow and consume resources for nothing.

Cheers,
David

0 Karma

corecomputetool
New Member

Thanks for the update.

0 Karma

DavidHourani
Super Champion

Most welcome, use the tstats when trying to access metadata and display a count by index, host or even sourcetype. Let me know if you're getting faster results with this search 🙂

0 Karma

Shan
Builder

@corecomputetools,

Please try below query ..

 index=* | chart count by sourcetype | sort limit=10 -count

index=* | chart count by sourcetype | sort -count | head 10

Thanks..

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@corecomputetools

Have you tried limit?

| chart count by sourcetype | sort limit=10 -count

0 Karma

corecomputetool
New Member

Thank you !!

0 Karma

corecomputetool
New Member

no, this limit=1denotes of ?

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

limit=10 display top 10 values.

index=_internal | chart count by sourcetype | sort limit=10 -count
0 Karma

corecomputetool
New Member

Hi Kamlesh,

Thank you for the immediate response.

It worked with the above command. :):)

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@corecomputetools

Glad to help you. Please upvote any comments which help you.

Happy Splunking

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...