How to get top 10 data source from Splunk ?

[corecomputetool]

is this command is correct ?

** | chart count by sourcetype | sort count desc*

[DavidHourani]

Hi @corecomputetools,

Use the following for getting the list of top indexes :

|tstats count where index=* by index | sort limit=10 -count

For index and sourcetype:

|tstats count where index=* by index,sourcetype | sort limit=10 count

PS: Avoid using index=* as it will run very slow and consume resources for nothing.

Cheers,
David

[corecomputetool]

Thanks for the update.

[DavidHourani]

Most welcome, use the tstats when trying to access metadata and display a count by index, host or even sourcetype. Let me know if you're getting faster results with this search 🙂

[Shan · Accepted solution]

@corecomputetools,

Please try below query ..

 index=* | chart count by sourcetype | sort limit=10 -count

index=* | chart count by sourcetype | sort -count | head 10

Thanks..

[kamlesh_vaghela]

@corecomputetools

Have you tried limit?

| chart count by sourcetype | sort limit=10 -count

[corecomputetool]

Thank you !!

[corecomputetool]

no, this limit=1denotes of ?

[kamlesh_vaghela]

limit=10 display top 10 values.

index=_internal | chart count by sourcetype | sort limit=10 -count

[corecomputetool]

Hi Kamlesh,

Thank you for the immediate response.

It worked with the above command. :):)

[kamlesh_vaghela]

@corecomputetools

Glad to help you. Please upvote any comments which help you.

Happy Splunking