Splunk Search
Highlighted

stats question

Explorer

Here is my search command:

index="vsapi" | stats dc(guid) as count by os_name, blob_virusinfo_detectionname | sort -count | sort +os_name
  1. how can I output top 50 for "each" os_name?
  2. if I want to add time interval on filename or in csvfile for weekly, how can I set it? (ex: 20110520-20110526-sortbyosname.csv)

thanks

Tags (3)
0 Karma
Highlighted

Re: stats question

SplunkTrust
SplunkTrust

I don't understand your second question, but I think the first one should be pretty easy to do. The built-in top search command supports a by-clause. You can do a | top limit=50 blob_virusinfo_detectionname by os_name (Or whatever other field you with to count the top 50 of by OS). http://www.splunk.com/base/Documentation/latest/SearchReference/Top

View solution in original post

0 Karma
Highlighted

Re: stats question

Explorer

hi, thanks your reply,
it have show limit 50 for each osname, but it's not the "top" 50 for count. I need top 50 dc(guid) as count for each osname.

about second question, I mean when setting seacrh & report, it will send csv file in email, how do I add the query date in filename? (ex: query interval -7d@d -> @d)

regards

0 Karma