Splunk Search

query to get top 10 users

splunkuseradmin
Path Finder

Hello everybody,

I am getting data in "index=test", I am trying to get top 10 Calling userid's with there call count.
device_type="device1" so far i have

thanks

Tags (1)
0 Karma

renjith_nair
Legend

@splunkuseradmin ,

Try

index="collab_uc_cdr" NOT INTEGER NOT globalCallID_callId 
( sourcetype=cisco_cdr OR sourcetype=cisco_cdr-* OR sourcetype=cucm_cdr ) ( globalCallId_ClusterID=AMR-Corp-CCM11XX OR globalCallId_ClusterID=AMR-Corp-CCM12XX OR globalCallId_ClusterID=AMR-Corp-CCM13XX OR globalCallId_ClusterID=AMR-Corp-CCM14XX OR globalCallId_ClusterID=AMR-Corp-CCM15XX ) duration>0   device_type="Jabber" eventtype="outgoing_call" 
|stats count by globalCallId_ClusterID,callingPartyUnicodeLoginUserID 
|sort - count |head 10
Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...