Splunk Search

Viewing beyond the top 10 results within an extracted field

ebenioff
New Member

I'm currently running searches to track the behavior of users on a particular mobile application. The first step in this is identifying which users to track, for which I run a query over a couple of weeks that returns an immense volume of logs and extract a userID field. When I select the userID field, Splunk shows me the top ten most prevalent userIDs, i.e. my most active users. This system has worked fine when I needed the highest activity users, but now I need low activity users as well and I'm wondering if there is any way to view the top 100 or all the userID's that are organized into the userID field.

Tags (2)
0 Karma

FunPolice
Path Finder

You can't sort on a field that doesn't exist yet. Try replacing

| sort count | head 10 | stats count by userId 

with

 | stats count by userId | sort count
0 Karma

twinspop
Influencer
| stats count by userID | sort - count
0 Karma

ebenioff
New Member

I got this to work for some sample queries, but can't get it to work for the actual query I need to run. What I've tried is:

index!="x" instance!="cs" logName="/mobile/direct/" logRecordTypeU=1 NOT logName="/mobile/direct/2.0.adobeair/" |fields logName, _time, organizationId, userId | rex field=logName "/mobile/direct/2..0.(?[^/])/.*" | where not isnull(device) | timechart span=2w dc(userId) as uniqueUsers by device | sort count | head 10 | stats count by userId

I'm pretty sure this is just a syntax error, but I don't know what exactly the error is.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...