Splunk Search

How to use top in timechart

mprreddy51
Explorer

Hi All,

I have a requirement to use TOP 4 in the timechart command:

Below is my search:

index=_internal |timechart count by sourcetype limit=5 span=1d|addcoltotals

(7DAYS DATA)
I need the top 4 column values of (sourcetype) as shown in the screenshot like SPLUNKD,SPLUNK_UI_ACCESS,SPLUNK_WEB_ACCESS,SPLUNK_WEB_SERVICE only
alt text
Thanks
PR

0 Karma
1 Solution

somesoni2
Revered Legend

Try like this

index=_internal | bucket span=1d _time | stats count by _time sourcetype | eventstats sum(count) as total by sourcetype | sort - total | streamstats current=f window=1 values(total) as prev | eval sno=case(isnull(prev),1,prev=total,0,1=1,1) | accum sno | where sno<5 | table _time sourcetype count | xyseries _time sourcetype count | addcoltotals

View solution in original post

somesoni2
Revered Legend

Try like this

index=_internal | bucket span=1d _time | stats count by _time sourcetype | eventstats sum(count) as total by sourcetype | sort - total | streamstats current=f window=1 values(total) as prev | eval sno=case(isnull(prev),1,prev=total,0,1=1,1) | accum sno | where sno<5 | table _time sourcetype count | xyseries _time sourcetype count | addcoltotals

mprreddy51
Explorer

Thanks Somesh

0 Karma

sundareshr
Legend

Couldn't the top 4 sourcetypes be different for each day?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...