How to search the most frequently indexed lines in Splunk?

[raghavarora12]

Hi,

I would like to know how can we get top 10 or 20 lines which get indexed in Splunk from our log files.
This is to to get those lines and tune them so that they do not consume most part of Splunk data indexing and reduce the usage so as to give way to other lines/data.

In other words, to get the set of lines which get printed very often in Splunk and consume maximum size of indexed data.

Early response will be appreciated.

[hartfoml]

I think you are asking about what logs generate the most traffic in splunk

you can use the punctuation field to find similer logs from different systems like this * | top punct

Be sure to use this for only a short time interval (5 or 15 minutes) as this could be a very intensive dense search

[somesoni2]

I think you need to user Splunk's cluster command. Have a look at these links

http://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/Cluster
http://blogs.splunk.com/2014/07/28/splunk-command-cluster/