Splunk Search

Top 5 events for every month

emamedov
Explorer

I'm currently using the following log statement:

Jun-28 12:00:28 | INFO| [Controller:116] Downloading file content: fileName:  [Way Too Easy.pdf]

The intent is to generate a result that lists the top 5 downloads for every month and the percentage of downloads compared to every other event in that month. It would look something along the lines of:

alt text

Using the the following search string gets me close to it, but not quite.

eventtype="document-downloads" | eval Month=strftime(_time,"%m/%Y") | top limit=5 fileName by Month
0 Karma
1 Solution

ryanoconnor
Builder

See if the following gets you what you need:

 eventtype="document-downloads" | top limit=5 fileName by date_month | eventstats sum(count) as sum by date_month | eval percent=count/sum | table date_month fileName count percent

I tested this trying to do the same thing you did, except with the top 5 Windows Event Logs for given months. See the following search.

index=wineventlog| top limit=5 EventCode by date_month | eventstats sum(count) as sum by date_month | eval percent=count/sum | table date_month EventCode count percent

View solution in original post

ryanoconnor
Builder

See if the following gets you what you need:

 eventtype="document-downloads" | top limit=5 fileName by date_month | eventstats sum(count) as sum by date_month | eval percent=count/sum | table date_month fileName count percent

I tested this trying to do the same thing you did, except with the top 5 Windows Event Logs for given months. See the following search.

index=wineventlog| top limit=5 EventCode by date_month | eventstats sum(count) as sum by date_month | eval percent=count/sum | table date_month EventCode count percent

emamedov
Explorer

It was close, this is what I ended up with:

eventtype="document-downloads" | eval Month=strftime(_time,"%m/%Y") 
| top limit=10 fileName by Month 
| stats list(*) as * by Month 
| table Month fileName count percent
0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...