Splunk Search

timechart count by source, top talker by span

dwengi
Engager

Hi Everyone,

I'm trying to craft a timechart that shows the top "hits per source" and then only display the top source per the 5 minute span.

something like this "sourcetype=firewall | timechart span=5m count by src limit=1"

but this will only display 1 source, not the 1 top source per slice of time.

Thoughts?

Tags (1)
0 Karma
1 Solution

acdevlin
Communicator

You might want to try the Bucket command instead of timechart; it will group your events into sets based upon a span you define. To find the single source you're interested in, I would then suggest the Top command and set its limit to 1.

The overall query I tried looked something like this:

... | bucket _time span=5m | top src by _time limit=1

I can't guarantee it's the single most efficient method of solving the problem, but I'm pretty sure it will return the results you are looking for.

Does this help answer your question?

View solution in original post

acdevlin
Communicator

You might want to try the Bucket command instead of timechart; it will group your events into sets based upon a span you define. To find the single source you're interested in, I would then suggest the Top command and set its limit to 1.

The overall query I tried looked something like this:

... | bucket _time span=5m | top src by _time limit=1

I can't guarantee it's the single most efficient method of solving the problem, but I'm pretty sure it will return the results you are looking for.

Does this help answer your question?

dwengi
Engager

That worked beautifully, thank you!

0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...