Splunk Search

Why is the top command not working when searching in two indexes?

lmedina
New Member

Hello all,

For some reason, the search below isn't working for me... I am trying to search for the Top 25 Business Units that have triggered a DLP incident and sort it by those incidents... Unsure if it's the lack of caffeine, but I was under the impression this would work...

(index=dlp OR index=msad) (sourcetype=intel:dlp OR sourcetype=ActiveDirectory)  IncidentType="*" department="*" 
| Top 25 department
| sort by IncidentType

Greatly appreciate your inputs.

0 Karma

puneethgowda
Communicator

use double quote when for sourcetype=intel:dlp ---- sourcetype="intel:dlp"

0 Karma

lmedina
New Member

Thank you puneethgowda - but still no data... I've been trying other constants but no results.

0 Karma

puneethgowda
Communicator

index=dlp sourcetype=intel:dlp OR index=msad sourcetype=ActiveDirectory

Try this

0 Karma

puneethgowda
Communicator

index="dlp" sourcetype="intel:dlp" OR index="msad" sourcetype="ActiveDirectory"

add double quote

0 Karma

lmedina
New Member

Nope...

This is when the data comes...

(index=dlp OR index=msad) (sourcetype=intel:dlp OR sourcetype=ActiveDirectory)

0 Karma

sundareshr
Legend

Try this

(index=dlp OR index=msad) (sourcetype=intel:dlp OR sourcetype=ActiveDirectory) IncidentType="" department="" | top 25 department by IncidentType | sort by IncidentType

lmedina
New Member

Thank you sundareshr - but still no data... I've been trying other constants but no results.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...