Splunk Search

How to sum top30 and then sum top31-100 and then sum top101-500

lihongyan_84
Explorer

I have use sort event from big to small ,now i want to sum 1-30,31-100,101-500,501-3000,3000- .how to do it ? thanks in advance.

Tags (3)
0 Karma

lihongyan_84
Explorer

Thanks ,vbumgarner!

0 Karma

vbumgarner
Contributor

Something like this should do it:

* | top limit=100 foo | eval a=1 | accum a | rangemap field=a 1-30=1-30 31-100=31-100 101-500=101-500 501-3000=501-3000 default=large | stats sum(count) by range
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...