Splunk Search

How to get top 10 values in splunk search ?

kavyaa
Explorer

Hi,
I want to get top 10 src_ip . I have selected descending order for recv_bytes column .
Please help me.
Query as follows
source="F:\Splunk_Log Files\*" status ="Allow" src_ip | stats sum(recv_bytes) by src_ip .
alt text

Tags (2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Are you looking for this?

source="F:Splunk_Log Files*" status ="Allow" src_ip | stats sum(recv_bytes) as sum_recv_bytes by src_ip | sort - sum_recv_bytes | head 10

View solution in original post

richgalloway
SplunkTrust
SplunkTrust
source="F:Splunk_Log Files*" status ="Allow" src_ip | stats sum(recv_bytes)  as Bytes by src_ip | top limit=10 Bytes
---
If this reply helps you, Karma would be appreciated.

martin_mueller
SplunkTrust
SplunkTrust

Are you looking for this?

source="F:Splunk_Log Files*" status ="Allow" src_ip | stats sum(recv_bytes) as sum_recv_bytes by src_ip | sort - sum_recv_bytes | head 10
Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...