Top 5 events for every month

[emamedov]

I'm currently using the following log statement:

Jun-28 12:00:28 | INFO| [Controller:116] Downloading file content: fileName:  [Way Too Easy.pdf]

The intent is to generate a result that lists the top 5 downloads for every month and the percentage of downloads compared to every other event in that month. It would look something along the lines of:

Using the the following search string gets me close to it, but not quite.

eventtype="document-downloads" | eval Month=strftime(_time,"%m/%Y") | top limit=5 fileName by Month

[ryanoconnor · Accepted solution]

See if the following gets you what you need:

 eventtype="document-downloads" | top limit=5 fileName by date_month | eventstats sum(count) as sum by date_month | eval percent=count/sum | table date_month fileName count percent

I tested this trying to do the same thing you did, except with the top 5 Windows Event Logs for given months. See the following search.

index=wineventlog| top limit=5 EventCode by date_month | eventstats sum(count) as sum by date_month | eval percent=count/sum | table date_month EventCode count percent

[emamedov]

It was close, this is what I ended up with:

eventtype="document-downloads" | eval Month=strftime(_time,"%m/%Y") 
| top limit=10 fileName by Month 
| stats list(*) as * by Month 
| table Month fileName count percent