is this command is correct ?
** | chart count by sourcetype | sort count desc*
@corecomputetools,
Please try below query ..
index=* | chart count by sourcetype | sort limit=10 -count
index=* | chart count by sourcetype | sort -count | head 10
Thanks..
Hi @corecomputetools,
Use the following for getting the list of top indexes :
|tstats count where index=* by index | sort limit=10 -count
For index and sourcetype:
|tstats count where index=* by index,sourcetype | sort limit=10 count
PS: Avoid using index=*
as it will run very slow and consume resources for nothing.
Cheers,
David
Thanks for the update.
Most welcome, use the tstats
when trying to access metadata and display a count by index, host or even sourcetype. Let me know if you're getting faster results with this search 🙂
@corecomputetools,
Please try below query ..
index=* | chart count by sourcetype | sort limit=10 -count
index=* | chart count by sourcetype | sort -count | head 10
Thanks..
@corecomputetools
Have you tried limit
?
| chart count by sourcetype | sort limit=10 -count
Thank you !!
no, this limit=1denotes of ?
limit=10
display top 10 values.
index=_internal | chart count by sourcetype | sort limit=10 -count
Hi Kamlesh,
Thank you for the immediate response.
It worked with the above command. :):)
@corecomputetools
Glad to help you. Please upvote any comments which help you.
Happy Splunking