Splunk Search

timechart count by source, top talker by span

dwengi
Engager

Hi Everyone,

I'm trying to craft a timechart that shows the top "hits per source" and then only display the top source per the 5 minute span.

something like this "sourcetype=firewall | timechart span=5m count by src limit=1"

but this will only display 1 source, not the 1 top source per slice of time.

Thoughts?

Tags (1)
0 Karma
1 Solution

acdevlin
Communicator

You might want to try the Bucket command instead of timechart; it will group your events into sets based upon a span you define. To find the single source you're interested in, I would then suggest the Top command and set its limit to 1.

The overall query I tried looked something like this:

... | bucket _time span=5m | top src by _time limit=1

I can't guarantee it's the single most efficient method of solving the problem, but I'm pretty sure it will return the results you are looking for.

Does this help answer your question?

View solution in original post

acdevlin
Communicator

You might want to try the Bucket command instead of timechart; it will group your events into sets based upon a span you define. To find the single source you're interested in, I would then suggest the Top command and set its limit to 1.

The overall query I tried looked something like this:

... | bucket _time span=5m | top src by _time limit=1

I can't guarantee it's the single most efficient method of solving the problem, but I'm pretty sure it will return the results you are looking for.

Does this help answer your question?

dwengi
Engager

That worked beautifully, thank you!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...