timechart count by source, top talker by span

[dwengi]

Hi Everyone,

I'm trying to craft a timechart that shows the top "hits per source" and then only display the top source per the 5 minute span.

something like this "sourcetype=firewall | timechart span=5m count by src limit=1"

but this will only display 1 source, not the 1 top source per slice of time.

Thoughts?

[acdevlin · Accepted solution]

You might want to try the Bucket command instead of timechart; it will group your events into sets based upon a span you define. To find the single source you're interested in, I would then suggest the Top command and set its limit to 1.

The overall query I tried looked something like this:

... | bucket _time span=5m | top src by _time limit=1

I can't guarantee it's the single most efficient method of solving the problem, but I'm pretty sure it will return the results you are looking for.

Does this help answer your question?

[dwengi]

That worked beautifully, thank you!