Splunk Search

How to get top 10 values in splunk search ?

kavyaa
Explorer

Hi,
I want to get top 10 src_ip . I have selected descending order for recv_bytes column .
Please help me.
Query as follows
source="F:\Splunk_Log Files\*" status ="Allow" src_ip | stats sum(recv_bytes) by src_ip .
alt text

Tags (2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Are you looking for this?

source="F:Splunk_Log Files*" status ="Allow" src_ip | stats sum(recv_bytes) as sum_recv_bytes by src_ip | sort - sum_recv_bytes | head 10

View solution in original post

richgalloway
SplunkTrust
SplunkTrust
source="F:Splunk_Log Files*" status ="Allow" src_ip | stats sum(recv_bytes)  as Bytes by src_ip | top limit=10 Bytes
---
If this reply helps you, Karma would be appreciated.

martin_mueller
SplunkTrust
SplunkTrust

Are you looking for this?

source="F:Splunk_Log Files*" status ="Allow" src_ip | stats sum(recv_bytes) as sum_recv_bytes by src_ip | sort - sum_recv_bytes | head 10
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...