Splunk Search

Top command causing issues with stats commands

alaking
Explorer

I am trying to audit bandwidth usage. The following search works as expected, except the URLS flood the URL field. I want the top 5:

Search here
| stats list(url) as URL sum(sent) as SentTotal sum(received) as ReceivedTotal by user
| eval Transferred=ReceivedTotal+SentTotal
| table user URL SentTotal ReceivedTotal Transferred
| sort -ReceivedTotal, -SentTotal 
| head 10

When I try to limit the domains listed using "top" like this:

Search here
| top limit=5 url by user
| stats list(url) as URL sum(sent) as SentTotal sum(received) as ReceivedTotal by user
| eval Transferred=ReceivedTotal+SentTotal
| table user URL SentTotal ReceivedTotal Transferred
| sort -ReceivedTotal, -SentTotal 
| head 10

The URL list is limited to 5 results per row, the problem is my sent/received/transferred fields go blank. And when I try putting top further down like this:

| stats list(url) as URL sum(sent) as SentTotal sum(received) as ReceivedTotal by user
| top limit=5 url by user
| eval Transferred=ReceivedTotal+SentTotal
| table user URL SentTotal ReceivedTotal Transferred
| sort -ReceivedTotal, -SentTotal 
| head 10

I get "No results found."

I am using Verbose mode and in every instance, I can see events on the events tab of the search window. I'm wondering if I am using top incorrectly.
Thanks is advance for reading and for any help you can provide.

0 Karma

acharlieh
Influencer

This sounds like a job for the still undocumented multireport offhand something like this:

... | multireport 
         [top limit=5 url by user]
         [stats sum(sent) as SentTotal sum(received) as ReceivedTotal by user]
    | stats list(url) as URL values(*Total) as *Total by user
    | eval Transferred=ReceivedTotal+SentTotal
    | table user URL SentTotal ReceivedTotal Transferred
    | sort 10 -Transferred

So what's going on? Using multireport we generate statistics for your two transforming commands separately, we then pull the results back together using stats, and go on our merry way.

I should note that you can use trickery with appendpipe, eval, and where to get similar results without venturing into the undocumented parts of Splunk too it's just more verbose.

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...