searching TOP query

[rootadmin]

Hi Folks, First time using splunk, i've managed to get my draytek router chucking the logs to splunk.

id like to perform a search so i can create a dashboard panel that shows me the TOP DNS queries, im not sure of the best way to do this, perhaps some one can point me in the right direction and provide me some code if needs be.

I would be really very qreatful for any help i can get.

Below is a log extract showing a dns lookup - raw data from the draytek

Jun 24 16:22:06 192.168.y.x Jun 24 16:20:51 Router: Local User (MAC=AA-BB-CC-DD-EE-FF): 192.168.y.x DNS -> 212.159.6.10 inquire orcart.facebook.com

[MHibbin]

You will firstly need to extract the fields you require..

http://docs.splunk.com/Documentation/Splunk/5.0.3/Knowledge/Addfieldsatsearchtime

You will then need to pipe your search to the top command on that field.

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Top