How to show top 3 wbrs blocked domains per month

[stawasen]

Hi,
I would like to get the top 3 wbrs blocked domains with a value below -6.2 prestented by each month for the last 12 months.

I have got the results that I want for the current month with the following line:
dest_domain!="-" action=block dest_domain="*" (x_wbrs_score<"-6.2") | top 3 dest_domain

Thanks by advance.

[sdaniels · Accepted solution]

I don't have the same data but using the bucket command should get you what you are looking for.

Assume you have a custom time looking at the last 6 months or whatever (in months)

dest_domain!="-" action=block dest_domain="*" (x_wbrs_score<"-6.2") | bucket _time span=1mon | stats count(dest_domain) by dest_domain, _time | top 3 showperc=false dest_domain by _time

[stawasen]

Thanks again! I changed the original syntax slightly and got the percentage numbers in relation to the overall blocked dest_domains for each month.

dest_domain!="-" action=block dest_domain="*" (x_wbrs_score<"-6.2" ) | bucket _time span=1month | top dest_domain by _time limit="3" showcount=false

[sdaniels]

Just take out the showperc=false and that will give you a percent value for each of the top 3. You can also use the 'useother=true' parameter and it will insert another row for each time bucket called OTHER that will show the percentage of the remaining data over that time.

| top 3 useother=true clientip by _time

[stawasen]

Thanks for your reply! I get the requested information, I have a follow-up question based on what I get for the current month. How do I get the percentage of the top 3 destination domains in relation to the rest for each month?

[sdaniels]

Did that work for you?